CVE-2026-8350: Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php

May 21, 2026 (updated June 24, 2026)

Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group. Any authenticated user with access to the bulk user assignment dashboard page can add any user email to any group and can remove legitimate admins.

References

documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes
github.com/advisories/GHSA-g7xp-jf3x-wcx4
nvd.nist.gov/vuln/detail/CVE-2026-8350

Code Behaviors & Features

Detect and mitigate CVE-2026-8350 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →