User Profile Access in Concrete CMS by Concrete5

CVE-2026-8327

What is CVE-2026-8327?

Concrete CMS versions below 9.5.0 are susceptible to a significant vulnerability allowing users to change their passwords without the need for reauthorization. The user-profile edit controller processes the complete raw POST data to the UserInfo::update() function without proper field whitelisting. This oversight enables registered users to change their passwords without providing their current password. Additionally, the flaw allows users to disable the per-user IP pinning feature in the session validator, which is designed to detect and prevent session hijacking. This vulnerability poses serious risks to user accounts and overall application security.

References