CVE-2026-8337: Concrete CMS is vulnerable to IDOR in surveys

May 22, 2026 (updated June 24, 2026)

Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private surveys are present on the site. An unauthenticated attacker can vote in the restricted survey by submitting the restricted optionID through the public survey’s endpoint.

References

documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes
github.com/advisories/GHSA-8c7c-h7px-267g
nvd.nist.gov/vuln/detail/CVE-2026-8337

Code Behaviors & Features

Detect and mitigate CVE-2026-8337 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →