CVE-2021-22966

Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted "view" permissions on the bulkupdate page, then users in that group can escalate to being an administrator with a specially crafted curl. Fixed by adding a check for group permissions before allowing a group to be moved. Concrete CMS Security team CVSS scoring: 7.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HCredit for discovery: "Adrian Tiron from FORTBRIDGE ( https://www.fortbridge.co.uk/ )"This fix is also in Concrete version 9.0.0

• CWE-863

• https://documentation.concretecms.org/developers/introduction/version-history/857-release-notesRelease Notes, Vendor Advisory
• https://hackerone.com/reports/1362747Permissions Required
• https://documentation.concretecms.org/developers/introduction/version-history/857-release-notesRelease Notes, Vendor Advisory
• https://hackerone.com/reports/1362747Permissions Required

Published

Nov 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22960The parse function in llhttp < 2.1.4 and < 6.0.6. ignores ch…6.5
• CVE-2021-22961A code injection vulnerability exists within the firewall so…9.8
• CVE-2021-22962An attacker can send a specially crafted request which could…9.1
• CVE-2021-22963A redirect vulnerability in the fastify-static module versio…6.1
• CVE-2021-22964A redirect vulnerability in the `fastify-static` module vers…8.8
• CVE-2021-22965A vulnerability in Pulse Connect Secure before 9.1R12.1 coul…7.5
• CVE-2021-22967In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allo…7.5
• CVE-2021-22968A bypass of adding remote files in Concrete CMS (previously …7.2
• CVE-2021-22969Concrete CMS (formerly concrete5) versions below 8.5.7 has a…5.3
• CVE-2021-2297Vulnerability in the Oracle VM VirtualBox product of Oracle …5.3
• CVE-2021-22970Concrete CMS (formerly concrete5) versions 8.5.6 and below a…7.5
• CVE-2021-22973On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1…7.5