Executive brief
Concrete CMS, a popular content management system, contains a security flaw in how it handles user profile updates. This vulnerability allows a registered user to change their account password without providing their current one, and to disable security features designed to prevent account hijacking. This could allow an attacker who has gained limited access to a user's account to lock out the legitimate owner or bypass session protections.
Technical details
Concrete CMS 9.5.0 and below contains a vulnerability in the user-profile edit controller. The controller passes the entire raw POST array to the UserInfo::update() method without implementing field whitelisting (CWE-915). This allows an authenticated attacker to modify sensitive account attributes that should require re-authentication, such as changing a password without providing the current one (CWE-620). Additionally, attackers can manipulate the session validator to disable per-user IP-pinning, effectively bypassing session-hardening measures intended to detect and prevent session hijacking. The issue is addressed in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed: NVD Published Date
- 2026-05-22: advisory: GitHub Advisory published
- 2026-06-24: patched: Advisory reviewed and updated with patch information