GitHub Advisoryadvisory · Packagist

GHSA-g7xp-jf3x-wcx4 Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php

HIGH Published 2026-05-21 Modified 2026-06-24 Official page ↗
Aliases
CVE-2026-8350
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-863
Reviewed
2026-06-24

Affected packages

• Packagist concrete5/concrete5: < 9.5.1 → fixed in 9.5.1

Description

Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group. Any authenticated user with access to the bulk user assignment dashboard page can add any user email to any group and can remove legitimate admins.

Related

Alias · CVE (1)

  • CVE-2026-8350 Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References