CVE-2026-8337
Analyzed Analyzed - Analysis Complete
IDOR Vulnerability in Concrete CMS Surveys

Publication date: 2026-05-21

Last updated on: 2026-05-26

Assigner: ConcreteCMS

Description
Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private surveys are present on the site. An unauthenticated attacker can vote in the restricted survey by submitting the restricted optionID through the public survey’s endpoint. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks  Zer0daySec https://github.com/Zee99y  for reporting
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-21
Last Modified
2026-05-26
Generated
2026-06-11
AI Q&A
2026-05-22
EPSS Evaluated
2026-06-10
NVD
CVE-2026-8337
EUVD
EUVD-2026-31359
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
concretecms concrete_cms to 9.5.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-565 The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

Concrete CMS versions 9.5.0 and below have an Insecure Direct Object Reference (IDOR) vulnerability in their survey feature.

This vulnerability occurs when a site is configured to have both public and private surveys.

An unauthenticated attacker can exploit this by submitting a restricted optionID through the public survey's endpoint, effectively allowing them to vote in a restricted survey without authorization.

Impact Analysis

This vulnerability allows unauthorized users to participate in restricted surveys, potentially skewing survey results.

It can lead to inaccurate data collection and undermine the integrity of survey-based decisions or analytics.

Since the attacker does not need to be authenticated, it increases the risk of abuse from external sources.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8337. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart