CSRF Vulnerability in Concrete CMS Affects Version Management

CVE-2026-8340

What is CVE-2026-8340?

Concrete CMS versions 9.5.0 and earlier are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability affecting the file version approval process. This vulnerability allows an attacker to trick a user, who possesses the 'edit_file_contents' permission, into publishing a file version of their choosing. The compromised user could inadvertently downgrade a document to an earlier version or activate an unpublished version from a co-editor, thereby potentially exposing sensitive content or causing unintended data loss. It is crucial for users to adopt security measures to mitigate this risk.

References