Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a classic Cross-Site Request Forgery (CSRF) in Concrete CMS's bulk page deletion functionality. The analysis began by examining the provided reference URLs, specifically the release notes for version 9.5.1, which confirmed a fix for CVE-2026-8411. By comparing the git tags for the vulnerable version 9.5.0 and the patched version 9.5.1, I identified a key commit f22b9dff59454391a50a255a39995bf635deea9e titled "Sec fixes 9.5.1". This commit contained multiple security fixes, including the one for the specified vulnerability. The diff for the file concrete/controllers/dialog/page/bulk/delete.php clearly shows the change that remediates the vulnerability. Inside the submit() method, the permission check $this->canAccess() was replaced by $this->validateAction(). In Concrete CMS, validateAction() is a standard method that checks for both user permissions and a valid CSRF token. The absence of this token validation in the submit function is the root cause of the CSRF vulnerability, as it allowed an attacker to trigger the page deletion action without the user's intent, as long as the user had an active session.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | >= 9.0.0RC1, < 9.5.1 | 9.5.1 |
