Skip to content
OpenAdvisories
Medium · 6.3 Public exploit CVE-2026-8337 EUVD-2026-31359GHSA-8c7c-h7px-267g

Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys

Published May 21, 2026 · Updated May 22, 2026 · Assigned by ConcreteCMS

Vendor: Concrete CMS Product: Concrete CMS Package: concrete5/concrete5 Ecosystem: Packagist

Description

Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private surveys are present on the site. An unauthenticated attacker can vote in the restricted survey by submitting the restricted optionID through the public survey’s endpoint. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks  Zer0daySec https://github.com/Zee99y  for reporting

Affected products

VendorProductAffectedFixed
Concrete CMS Concrete CMS — —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • aj2108/CVE-2026-8337 ★ 0 · Jul 31, 2026

    CVE-2026-8337 is an Insecure Direct Object Reference (IDOR) vulnerability in Concrete CMS that affects the Survey feature. Unlike CVE-2026-8347 (which involved Express associations), this vulnerabili…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist concrete5/concrete5 < 9.5.1 9.5.1 GHSA-8c7c-h7px-267g

References