{"answers":{"affected":"2 open source packages ship an affected version, including concrete5/concrete5. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-8337 in the wild and no public exploit code.","fix":"Upgrade concrete5/concrete5 to 9.5.1 or later.","what":"CVE-2026-8337 is a medium-severity missing authorization vulnerability in Concretecms Concrete Cms, published on 21 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-8337 and fix it if it is affected.\n\nWhat it is: CVE-2026-8337 is a medium-severity missing authorization vulnerability in Concretecms Concrete Cms, published on 21 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-8337 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- concrete5/concrete5 (Packagist): affected all versions; fixed in 9.5.1\n- concrete5/concrete5 (Packagist): affected all versions; fixed in 9.5.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-8337/ (Markdown: https://insights.sbomify.com/CVE-2026-8337/index.md)","id":"CVE-2026-8337","markdown":"https://insights.sbomify.com/CVE-2026-8337/index.md","name":"CVE-2026-8337","record":{"aliases":["GHSA-8c7c-h7px-267g"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"Concrete CMS","requires_auth":"none","summary":"An unauthenticated attacker can vote in restricted private surveys by manipulating option IDs in public survey endpoints, requiring specific site configuration.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"ConcreteCMS","cpe":[{"product":"concrete_cms","vendor":"concretecms"}],"cvss":{"score":6.3,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"},{"id":"CWE-565","name":"Reliance on Cookies without Validation and Integrity Checking"}],"description":"Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private surveys are present on the site. An unauthenticated attacker can vote in the restricted survey by submitting the restricted optionID through the public survey’s endpoint. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks  Zer0daySec https://github.com/Zee99y  for reporting","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":"2026-07-31","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-07-31T19:59:14Z","kind":"github_poc","ref":"https://github.com/aj2108/CVE-2026-8337","stars":0,"title":"CVE-2026-8337 is an Insecure Direct Object Reference (IDOR) vulnerability in Concrete CMS that affects the Survey feature. Unlike CVE-2026-8347 (which involved Express associations), this vulnerability allows an unauthenticated attacker to participate in a restricted/private survey under specific site configurations."}],"tier":"poc_unverified"},"has_fix":true,"headline":"Concrete CMS is vulnerable to IDOR in surveys","id":"CVE-2026-8337","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":"concretecms:concrete_cms","products":["concretecms:concrete_cms"],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":1,"next":{"headline":"Authentication and Authorization Bypass in Coverity Connect","id":"CVE-2026-8338"},"packages":[{"ecosystem":"Packagist","fixed":["9.5.1"],"introduced":["0"],"last_affected":[],"package":"concrete5/concrete5","purl":null,"source":"GHSA-8c7c-h7px-267g"},{"ecosystem":"Packagist","fixed":["9.5.1"],"introduced":["0"],"last_affected":[],"package":"concrete5/concrete5","purl":"pkg:composer/concrete5/concrete5","source":"GHSA-8c7c-h7px-267g"}],"prev":{"headline":"Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands","id":"CVE-2026-8336"},"products":["Concrete CMS"],"published":"2026-05-21","related":[{"cvss_score":9.8,"headline":"Concrete CMS allows unauthorized access because directories can be created with insecure permissions","id":"CVE-2023-48648","kev_date_added":null,"published":"2023-11-17"},{"cvss_score":9.8,"headline":"Code injection in concrete CMS","id":"CVE-2022-21829","kev_date_added":null,"published":"2022-06-24"},{"cvss_score":9.8,"headline":"Server-Side Request Forgery vulnerability in concrete5","id":"CVE-2021-22958","kev_date_added":null,"published":"2021-10-07"},{"cvss_score":9.8,"headline":"Path traversal in n/a","id":"CVE-2021-40098","kev_date_added":null,"published":"2021-09-27"},{"cvss_score":9.4,"headline":"Concrete CMS Vulnerable to Relative Path Traversal","id":"CVE-2026-8134","kev_date_added":null,"published":"2026-05-21"},{"cvss_score":9.1,"headline":"Path traversal in Concrete CMS","id":"CVE-2022-30117","kev_date_added":null,"published":"2022-06-24"},{"cvss_score":9.1,"headline":"Deserialization in n/a","id":"CVE-2021-40102","kev_date_added":null,"published":"2021-09-24"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-22","vendors":["Concrete CMS"]},"summary":"An unauthenticated attacker can vote in restricted private surveys by manipulating option IDs in public survey endpoints, requiring specific site configuration.","url":"https://insights.sbomify.com/CVE-2026-8337/"}