CVE-2026-8337
Received Received - Intake
IDOR Vulnerability in Concrete CMS Surveys

Publication date: 2026-05-21

Last updated on: 2026-05-21

Assigner: ConcreteCMS

Description
Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private surveys are present on the site. An unauthenticated attacker can vote in the restricted survey by submitting the restricted optionID through the public survey’s endpoint. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks  Zer0daySec https://github.com/Zee99y  for reporting
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-21
Last Modified
2026-05-21
Generated
2026-05-22
AI Q&A
2026-05-22
EPSS Evaluated
N/A
NVD
CVE-2026-8337
EUVD
EUVD-2026-31359
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms to 9.5.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-565 The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

Concrete CMS versions 9.5.0 and below have an Insecure Direct Object Reference (IDOR) vulnerability in their survey feature.

This vulnerability occurs when a site is configured to have both public and private surveys.

An unauthenticated attacker can exploit this by submitting a restricted optionID through the public survey's endpoint, effectively allowing them to vote in a restricted survey without authorization.


How can this vulnerability impact me? :

This vulnerability allows unauthorized users to participate in restricted surveys, potentially skewing survey results.

It can lead to inaccurate data collection and undermine the integrity of survey-based decisions or analytics.

Since the attacker does not need to be authenticated, it increases the risk of abuse from external sources.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart