aj2108/cve-2026-8337Technical write-up for CVE-2026-8337, an IDOR in Concrete CMS Survey that lets unauthenticated attackers influence private survey results by submitting a crafted optionID to a public survey endpoint.
CVE-2026-8337 is an Insecure Direct Object Reference (IDOR) vulnerability in Concrete CMS that affects the Survey feature. Unlike CVE-2026-8347 (which involved Express associations), this vulnerability allows an unauthenticated attacker to participate in a restricted/private survey under specific site configurations.
Concrete CMS 9.5.0 and earlier contains an authorization flaw in its survey functionality. If a website is configured with both a public survey and a restricted (private) survey, an attacker can submit the optionID of a restricted survey to the public survey endpoint.
Because the application does not properly validate that the submitted optionID belongs to the public survey being answered, the vote is recorded for the restricted survey instead. This allows an unauthenticated user to influence the results of surveys they should not be able to access.
Product: Concrete CMS Affected Versions: 9.5.0 and earlier Fixed Version: 9.5.1
CWE-639: Authorization Bypass Through User-Controlled Key (IDOR) CWE-565: Reliance on Cookies without Validation and Integrity Checking (also assigned by the CNA)
The application validates the public survey endpoint but fails to verify that the submitted optionID actually belongs to that survey.
Conceptually:
User submits vote ↓ Public survey endpoint receives request ↓ Application accepts supplied optionID ↓ No validation that optionID belongs to this survey ↓ Vote recorded in restricted survey
Instead of enforcing the relationship between Survey ID and Option ID, the server trusts a user-controlled identifier.
Suppose a website contains:
Survey A (Public) Survey B (Private)
An attacker first votes in Survey A.
By intercepting the request (for example, using a web proxy) and replacing the submitted optionID with one belonging to Survey B, the attacker may cause the application to record a vote in the private survey because the server does not verify that the option belongs to the intended survey.
Successful exploitation can result in:
Unauthorized participation in private surveys. Manipulation of survey results. Loss of data integrity.
This vulnerability primarily impacts integrity, rather than confidentiality or availability.
CVSS v3.1 (NVD): 5.3 – Medium CVSS v4.0 (Concrete CMS CNA): 6.3 – Medium
Administrators should upgrade to Concrete CMS 9.5.1 or later. Developers should ensure that every submitted optionID is validated against the survey being answered and that authorization checks prevent users from interacting with restricted survey data through public endpoints.
