VulnSocial

CVE-2026-2994Disclosure(concretecms / concrete_cms)

LOWCVSS 6.8 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via group_id parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks z3rco for reporting

concretecms CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-352

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • concrete_cms

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • 3 total mentions across 1 day

Affected systems

Vendors
concretecms
Products
concrete_cms

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-03-04: 3Technical Details · 2026-03-04: 203-04
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets4 URLs
Full discourse3 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-2994 Cross-Site Request Forgery in Concrete CMS Group Configuration Below 9.4.... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2994 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3

    Post summary

    The notice informs about CVE‑2026‑2994, a CSRF vulnerability in Concrete CMS versions below 9.4, with no evidence of PoC, exploit, or patch details.

    0000040
    4.0K followersView on X
  • CVEarity@CVEarity
    General

    ⚡ New CVE Alert: CVE-2026-2994 📊 Severity: 2.3 🚨 Risk Level: Low 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-2994 #CVE-2026-2994 #CVE #Low #CyberSecurity #InfoSec https://t.co/YIbwUnPWOc

    Post summary

    The tweet merely announces CVE‑2026‑2994 as a low‑risk issue with the NVD link, providing no technical, exploitation, or mitigation details.

    0000036
    64 followersView on X
  • CyberDudeBivash® | Global Cybersecurity Company@cyberbivash
    Disclosure

    🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-2994 - Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group Intel Report: https://ift.tt/pGnMrPJ

    Post summary

    A new CSRF vulnerability (CVE-2026-2994) in Concrete CMS versions below 9.4.8 allows a rogue admin to exploit the anti‑spam allowlist group, but no PoC, exploit, or patch details are provided.

    0000042
    344 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appconcretecmsconcrete_cms---

Explore more

Back to dashboardconcretecms CVEsconcrete_cms vulnerabilities