Privilege Escalation Vulnerability in Concrete CMS by Concrete

CVE-2026-8350

What is CVE-2026-8350?

Concrete CMS versions 9.5.0 and earlier are susceptible to a security issue where missing authorization in the bulk user assignment functionality allows authenticated users to evade restrictions. These users can manipulate group memberships, including adding arbitrary email addresses to any group or removing authorized administrators. This weakness poses serious risks to the integrity of user permissions and can potentially lead to administrative access being compromised.

References