PoC Published for CVE-2026-8347: CVE-2026-8347

July 31, 2026 · GitHub · Severity: CRITICAL

A proof-of-concept (PoC) has been published for CVE-2026-8347, a vulnerability affecting Concrete CMS versions 9.5.0 and earlier. The flaw is an Insecure Direct Object Reference (IDOR) combined with incorrect authorization levels, specifically within the Express association Reorder dialog. This allows users with only view permissions to manipulate the ordering of associations for another entity, potentially leading to unauthorized changes in the system. The PoC repository, hosted on GitHub by user aj2108, was created on July 31, 2026, and provides a detailed demonstration of the exploit. Organizations using Concrete CMS versions 9.5.0 or earlier are at risk, as the vulnerability could be exploited by attackers to alter data structures without proper authorization. This poses a significant security threat, particularly for websites relying on Concrete CMS for content management. The publication of the PoC increases the urgency for affected entities to apply patches or updates to mitigate the risk. Concrete CMS users should monitor for official updates from the vendor and implement necessary security measures to prevent potential exploitation of this vulnerability.