2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8410

CVE-2026-8410: Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete. The The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8410

CVE-2026-8410:

2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	>= 9.0.0RC1, < 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a Cross-Site Request Forgery (CSRF) in the log deletion functionality of Concrete CMS. The provided information points to the affected path concrete/controllers/dialog/logs/bulk/delete. By analyzing the commits between the last vulnerable version (9.5.0) and the first patched version (9.5.1), I identified a security-related commit f22b9dff59454391a50a255a39995bf635deea9e. This commit contains a change in concrete/controllers/dialog/logs/bulk/delete.php where the submit() method's authorization check is changed from $this->canAccess() to $this->validateAction(). The validateAction() method in Concrete CMS is used to verify both user permissions and a CSRF token, while canAccess() typically only checks permissions. This change directly addresses the CSRF vulnerability. Therefore, the submit() function within the Concrete\Controller\Dialog\Logs\Bulk\Delete class is the vulnerable function.

Vulnerable functions

Concrete\Controller\Dialog\Logs\Bulk\Delete::submit

concrete/controllers/dialog/logs/bulk/delete.php

The `submit` function in the `Delete` controller is vulnerable to Cross-Site Request Forgery (CSRF). The original code used `$this->canAccess()` to authorize the action, which only checked if the user had permissions to clear logs but did not validate a CSRF token. An attacker could craft a malicious request to the endpoint `/ccm/system/dialogs/logs/bulk/delete/submit`. If an authenticated administrator with the necessary permissions visited a page containing this malicious request (e.g., in an image tag), the request would be executed without their knowledge, leading to the deletion of logs. The patch replaces `canAccess()` with `validateAction()`, which includes a CSRF token check, thus mitigating the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.