CVE-2026-8428

🗓️ 21 May 2026 20:24:11Reported by ConcreteCMSType

cve🔗 web.nvd.nist.gov👁 100 Views🌐 WEB

CVE-2026-8428: CSRF token not validated in Concrete CMS update controller before 9.5.0, enabling unauthorized updates.

Reporter	Title	Published	Views	Family All 14
attackerkb	CVE-2026-8428	21 May 202620:24	–	attackerkb
CNNVD	Concrete CMS Cross-Site Request Forgery Vulnerability	21 May 202600:00	–	cnnvd
Cvelist	CVE-2026-8428 CSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and below	21 May 202620:24	–	cvelist
EUVD	EUVD-2026-31340	21 May 202620:24	–	euvd
Github Security Blog	Concrete CMS is Vulnerable to Cross-Site Request Forgery	21 May 202621:30	–	github
Mend	CVE-2026-8428	21 May 202620:24	–	mend
NVD	CVE-2026-8428	21 May 202621:16	–	nvd
osv_cve	CVE-2026-8428 CSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and below	21 May 202620:24	–	osv_cve
osv_ghsa	GHSA-PRXR-VJGC-2CQ9 Concrete CMS is Vulnerable to Cross-Site Request Forgery	21 May 202621:30	–	osv_ghsa
Positive Technologies	PT-2026-42549	21 May 202600:00	–	ptsecurity

NVD

Vulners

Node

concretecms concrete_cmsRange<9.5.1

[
  {
    "vendor": "Concrete CMS",
    "product": "Concrete CMS",
    "collectionURL": "https://github.com/concretecms/concretecms",
    "repo": "https://github.com/concretecms/concretecms",
    "versions": [
      {
        "status": "affected",
        "version": "5.0",
        "lessThanOrEqual": "9.5.0",
        "versionType": "git"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
documentation	www.documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes

Parameter	Position	Path	Description	CWE
do_update	request body	/dashboard/system/update/update.php	The do_update() method in the update controller fails to validate the CSRF token for the 'do_update' action, allowing an attacker to trigger a core CMS update via a cross-site POST request.	CWE-352, CWE-829

23 Jul 2026 16:10Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.8

CVSS 47.5

EPSS0.00132

SSVC