What is GHSA-jqvq-gv67-3567?

GHSA-jqvq-gv67-3567 is a security advisory published by GitHub Security Advisories with Low severity. Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog

Which CVE IDs does GHSA-jqvq-gv67-3567 cover?

GHSA-jqvq-gv67-3567 covers the following CVE IDs: CVE-2026-8347. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-jqvq-gv67-3567?

GHSA-jqvq-gv67-3567 affects 1 product, including: composer/concrete5/concrete5:\u003c 9.5.1.

GHSA-jqvq-gv67-3567Low

Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog

Vendor

GitHub Security Advisories

Published

May 26, 2026

Last Modified

June 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-8347 →

📋 Description

Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express and relying on express entity ordering. Thanks Winston Crooker for reporting.

🎯 Affected products1

composer/concrete5/concrete5:< 9.5.1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-8347
https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes
https://github.com/advisories/GHSA-jqvq-gv67-3567