Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | >= 9.0.0RC1, < 9.5.1 | 9.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-8414, is a Cross-Site Request Forgery (CSRF) issue in Concrete CMS's event duplication functionality. The provided patch for version 9.5.1 clearly shows the fix. The analysis of the commit f22b9dff59454391a50a255a39995bf635deea9e reveals that the submit() method in concrete/controllers/dialog/event/duplicate.php was modified. The original code only checked if the user had permission to perform the action (canAccess()) but failed to verify if the request originated from a legitimate user action on the website. The patch adds the validateAction() call, which enforces CSRF token validation. This confirms that the submit() method was the vulnerable function, as it could be triggered by a forged request from an external site, leading to the duplication of calendar events without the user's consent.
