CVE-2026-8239
Missing Authorization: Is CVE-2026-8239 real, exploitable, or a false positive? Here's the community verdict.
Community verdict: No field verdicts yet. Be the first practitioner to weigh in.
signals
public sources
Moderate signals. Triage by your actual exposure and reachability.
cisa ssvc
CISA Vulnrichment · assessed
CISA decision, by how critical the affected system is to you:
- low impact → Track
- medium impact → Track
- high impact → Attend
Track: normal patch cycle · Track*: watch closely · Attend: patch sooner · Act: patch now. About SSVC ↗
public exploits
links to sources — we don’t host codeUnverified proof-of-concept code has been published. It may or may not be functional — assess before relying on it.
affected packages
GHSA-2xp7-rpvc-pjwc · GitHub rates it moderate- Composerconcrete5/concrete5
- Vulnerable
- < 9.5.1
- Fixed in
- 9.5.1
Source: GitHub Advisory Database (CC-BY 4.0), via OSV.dev. Check your lockfile version against the ranges above.
baseline read
auto · not a community verdict
Low signal — verdict needed
Few public signals point to active risk. Whether a scanner hit here is a true or false positive depends on your version and config — community verdicts decide.
Based on CVSS · FIRST EPSS
Confirm or dispute →CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms existence and returns rating score for any message by ID. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2026-8239)<a href="https://www.truepositive.app/cve/CVE-2026-8239"><img src="https://www.truepositive.app/cve/CVE-2026-8239/badge.svg" alt="TruePositive verdict for CVE-2026-8239"></a>Live badge that updates automatically as the community verdict changes.
timeline
- CISA SSVC assessment · exploitation: none
- Published by NVD
Score and exploit changes tracked since .
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: A curated baseline from public sources, shown separately from community verdicts.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
No confirmed in-the-wild exploitation or public exploit was found for this yet.
Add a field note or remediationoptional
Related CVEs
Same weakness: CWE-862 · Missing Authorization.
- CVE-2022-0543CRIT 10KEVEPSS 99%
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
- CVE-2023-52163HIGH 8.8KEVEPSS 97%
Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- CVE-2025-20362MED 6.5KEVEPSS 87%
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.
- CVE-2025-6205CRIT 9.1KEVEPSS 74%
A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.
- CVE-2021-30657MED 5.5KEVEPSS 69%
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may have been actively exploited..
- CVE-2024-57726CRIT 9.9KEVEPSS 66%
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.