6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8337

CVE-2026-8337: Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys

Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private surveys are present on the site. An unauthenticated attacker can vote in the restricted survey by submitting the restricted optionID through the public survey’s endpoint. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Zer0daySec https://github.com/Zee99y for reporting

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8337

CVE-2026-8337:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	< 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided security vulnerability, CVE-2026-8337, in Concrete CMS reveals an Insecure Direct Object Reference (IDOR) vulnerability within the survey functionality. The vulnerability allows an unauthenticated attacker to vote in a restricted survey. By examining the provided patch, specifically the changes in concrete/blocks/survey/controller.php, the root cause of the vulnerability was identified in the action_form_save_vote function. The original code failed to validate that the optionID submitted by the user belonged to the survey (bID) they were interacting with. An attacker could exploit this by finding a valid optionID from a restricted survey and submitting it through a public survey's voting mechanism. The patch effectively addresses this by adding a validation step that checks if the optionID is associated with the correct survey bID before processing the vote, thus closing the IDOR vulnerability.

Vulnerable functions

Concrete\Block\Survey\Controller::action_form_save_vote

concrete/blocks/survey/controller.php

The vulnerability lies in the `action_form_save_vote` function within the `concrete/blocks/survey/controller.php` file. Prior to the patch, this function directly used the `optionID` from the user's request without verifying that this option belonged to the specific survey (`bID`) being displayed. This allowed an attacker to vote in a restricted survey by submitting a valid `optionID` from that survey to the public survey's voting endpoint. The patch mitigates this by adding a database query to ensure the provided `optionID` is a valid option for the current survey's block ID (`bID`) before recording the vote.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.