CVE-2026-8337CWE-565CWE-639

Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys

Medium · published May 21, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private surveys are present on the site. An unauthenticated attacker can vote in the restricted survey by submitting the restricted optionID through the public survey’s endpoint. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks  Zer0daySec https://github.com/Zee99y  for reporting

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00324 · 24.2th percentile
Weaknesses
CWE-565 · Reliance on Cookies without Validation and Integrity Checking; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-21T21:13Z
EPSS history
Timeline
  • 21 MAY 21:13Z
    Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys
    cvelistv5