5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8327

CVE-2026-8327: Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update() without field whitelisting resulting in password change without requiring the current password and also resulting in registered users able to disable the per-user-IP-pinning in the session validator which is meant to detect hijacking. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks 0x4c616e for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8327

CVE-2026-8327:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	< 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2026-8327, lies in the user profile update functionality of Concrete CMS. The root cause is improper input validation in the save() method of the EditProfile controller. The controller was accepting the entire raw POST request data and passing it to the UserInfo::update() method. This allowed an authenticated user to modify any attribute of their user object, even those not intended to be editable through this form.

Specifically, two issues were identified:

Password Change without Reauthorization: A user could add uPassword and uPasswordConfirm fields to their request to change their password without supplying their current password, as the controller did not enforce this check and UserInfo::update() would blindly apply the change.
Session-Hardening Bypass: A user could modify other security-related attributes, such as the one controlling per-user IP pinning for sessions, effectively disabling this protection against session hijacking.

The patch addresses this in two main locations:

In concrete/controllers/single_page/account/edit_profile.php, the save() method was changed to use a whitelist approach. Instead of taking all POST data, it now initializes an empty array and only populates it with the specific fields that are allowed to be edited through this form.
As a defense-in-depth measure, the UserInfo::update() method in concrete/src/User/UserInfo.php was modified to only update the password if a special _allowPasswordUpdate flag is present in the data, which is only set by the save() method after it has validated the current password.

Therefore, during exploitation, a runtime profile would show calls to Concrete\Controller\SinglePage\Account\EditProfile::save() processing the malicious request, which in turn calls Concrete\Core\User\UserInfo::update() to persist the unauthorized changes.

Vulnerable functions

Concrete\Controller\SinglePage\Account\EditProfile::save

concrete/controllers/single_page/account/edit_profile.php

This function is the entry point for the vulnerability. It previously took all fields from the user's POST request and passed them directly to the `UserInfo::update()` method. This allowed a malicious user to submit fields that were not present on the form, such as a new password without the current one, or fields to disable security controls like session IP pinning.

Concrete\Core\User\UserInfo::update

concrete/src/User/UserInfo.php

This function is responsible for persisting user data changes to the database. It was vulnerable because it would update the user's password if a new password was provided in the input data, without any check to ensure the change was authorized (e.g., by verifying the current password). The fix adds a defense-in-depth check, ensuring the password is only updated when explicitly allowed by the calling controller.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.