7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8350

CVE-2026-8350: Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group

Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group. Any authenticated user with access to the bulk user assignment dashboard page can add any user email to any group and can remove legitimate admins. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Vincent55 for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8350

CVE-2026-8350:

7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	< 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in Concrete CMS allows any authenticated user with access to the "Bulk User Assignment" dashboard page to escalate their privileges. The root cause is a lack of authorization checks in the concrete/controllers/single_page/dashboard/users/bulk_user_assignment.php controller.

Specifically, the submit() function in the Concrete\Controller\SinglePage\Dashboard\Users\BulkUserAssignment controller did not verify if the user had the necessary permissions to assign or unassign the selected user groups. This allowed a low-privileged user to add any user (including themselves) to any group, such as the "Administrators" group, leading to a full privilege escalation. The view() function also lacked a permission check, making the vulnerable functionality accessible to a wider range of authenticated users.

The patch for CVE-2026-8350 introduces several checks:

It adds a canAccessGroupManagement() permission check in both the view() and submit() methods to ensure only authorized users can access and use this feature.
It introduces a new validateGroupSelection() method which checks the canAssignGroup() permission for each group being assigned or unassigned. This prevents users from assigning groups they are not supposed to manage.
The list of available groups is now filtered by filterByAssignable(), ensuring users only see and can select groups they are permitted to assign.

During exploitation, a runtime profiler would show calls to Concrete\Controller\SinglePage\Dashboard\Users\BulkUserAssignment::view() when accessing the page, and Concrete\Controller\SinglePage\Dashboard\Users\BulkUserAssignment::submit() when the malicious group assignment is performed.

Vulnerable functions

Concrete\Controller\SinglePage\Dashboard\Users\BulkUserAssignment::view

concrete/controllers/single_page/dashboard/users/bulk_user_assignment.php

This function was vulnerable because it failed to check if the user had the necessary permissions to access the bulk user assignment page. This allowed unauthorized users to view the page and proceed to exploit the submission functionality.

Concrete\Controller\SinglePage\Dashboard\Users\BulkUserAssignment::submit

concrete/controllers/single_page/dashboard/users/bulk_user_assignment.php

This function was critically vulnerable as it processed the user-to-group assignments without verifying if the logged-in user had the authority to assign or unassign the specified groups. An attacker could craft a request to this endpoint to add any user to any group, including the administrative group, leading to a full privilege escalation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.