Title: Concrete CMS, Description: Concrete CMS 9.5.0 y versiones anteriores no valida un token CSRF antes de procesar solicitudes a /dashboard/extend/update/do_update/<pkgHandle>. El método do_update() en concrete/controllers/single_page/dashboard/extend/update.php solo verifica canInstallPackages() antes de ejecutar upgradeCoreData() y upgrade() en el controlador del paquete nombrado. Debido a que el endpoint es una ruta GET que cambia de estado sin aplicación de token, un atacante puede forzar a un administrador autenticado a activar una actualización de paquete a través de una única navegación entre sitios. Para ser vulnerable, la víctima debe estar pasando canInstallPackages() y un paquete objetivo ya debe estar instalado. El equipo de seguridad de Concrete CMS otorgó a esta vulnerabilidad una puntuación CVSS v.4.0 de 7.5 con el vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Gracias a https://github.com/maru1009 por el informe.

{"timestamp":"2026-05-22T12:14:16.961823Z","id":"CVE-2026-8417","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Concrete CMS","product":"Concrete CMS","defaultStatus":"unaffected","collectionURL":"https://github.com/concretecms/concretecms","repo":"https://github.com/concretecms/concretecms","versions":[{"version":"5.0","lessThanOrEqual":"9.5.0","versionType":"git","status":"affected"}]}]

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OR
          *cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:* versions up to (excluding) 9.5.1

ConcreteCMS: https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Types: Release Notes

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() method in concrete/controllers/single_page/dashboard/extend/update.php checks only canInstallPackages() before executing upgradeCoreData() and upgrade() on the named package's controller. Because the endpoint is a state-changing GET route with no token enforcement, an attacker can force an authenticated administrator to trigger a package upgrade via a single cross-site navigation.In order to be vulnerable, the victim must be passing canInstallPackages() and and a target package must already be already installed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks  https://github.com/maru1009  for reporting.

AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE-352

https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes