2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8347

CVE-2026-8347: Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog

Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express and relying on express entity ordering. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8347

CVE-2026-8347:

2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	< 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an IDOR combined with a wrong authorization level in the Express association Reorder dialog in Concrete CMS. The analysis of the patch between version 9.5.0 and 9.5.1 revealed the vulnerable functions and the fixes.

The patch f22b9dff59454391a50a255a39995bf635deea9e addresses these issues in concrete/controllers/dialog/express/association/reorder.php.

Wrong Authorization Level: The canAccess() function was changed to require canEditExpressEntry permissions instead of the weaker canViewExpressEntry. This corrects the authorization check, preventing users with only view permissions from performing a modification action.
IDOR: The submit() function was modified to validate that the entries being reordered are part of the correct association. Before the patch, the function trusted the user-supplied list of entries, allowing an attacker to reorder entries in other, unrelated Express objects. The added validation loop ensures that only entries belonging to the current association are modified, thus fixing the IDOR vulnerability.

Additionally, the submit function was also patched to include a CSRF token validation (if ($this->validateAction())), fixing a separate CSRF vulnerability (CVE-2026-8415) in the same component.

Vulnerable functions

Concrete\Controller\Dialog\Express\Association\Reorder::canAccess

concrete/controllers/dialog/express/association/reorder.php

The `canAccess` method in the `Reorder` controller only checked if the user had `canViewExpressEntry` permissions. This was insufficient for an action that modifies data, allowing a user with view-only permissions to reorder entries. The patch changes this to require `canEditExpressEntry` permission.

Concrete\Controller\Dialog\Express\Association\Reorder::submit

concrete/controllers/dialog/express/association/reorder.php

The `submit` method was vulnerable to an Insecure Direct Object Reference (IDOR). It processed a list of entries to be reordered directly from the user's request without verifying that those entries actually belonged to the association being modified. An attacker could have supplied entry IDs from other express objects, leading to cross-entity state tampering. The patch adds a check to ensure that each entry being reordered is part of the correct association.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.