CVE-2026-8350: Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group
Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulkuserassignment.php which can lead to privilege escalation to Administrative Group. Any authenticated user with access to the bulk user assignment dashboard page can add any user email to any group and can remove legitimate admins. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Vincent55 for reporting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8350?
CVE-2026-8350 has a severity rating of high with a CVSS score of 7.5.
How does CVE-2026-8350 affect Concrete CMS?
CVE-2026-8350 allows any authenticated user to escalate privileges to the Administrative Group due to missing authorization in bulk_user_assignment.php.
How do I fix CVE-2026-8350?
To fix CVE-2026-8350, update Concrete CMS to version 9.5.1 or later, which addresses this vulnerability.
What can an attacker do with CVE-2026-8350?
An attacker can add or remove users from any group, potentially gaining administrative privileges.
When was CVE-2026-8350 published?
CVE-2026-8350 was published on May 21, 2026.