https://vulnerability.circl.lu/sightings/feed 2026-06-07T04:58:38.129136+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/799b66ee-f0cd-415c-a65b-0835b042f3ed/export 2026-06-07T04:58:38.487518+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "799b66ee-f0cd-415c-a65b-0835b042f3ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22966", "type": "seen", "source": "https://t.me/cibsecurity/32746", "content": "\u203c CVE-2021-22966 \u203c\n\nPrivilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted \"view\" permissions on the bulkupdate page, then users in that group can escalate to being an administrator with a specially crafted curl. Fixed by adding a check for group permissions before allowing a group to be moved. Concrete CMS Security team CVSS scoring: 7.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HCredit for discovery: \"Adrian Tiron from FORTBRIDGE ( https://www.fortbridge.co.uk/ )\"This fix is also in Concrete version 9.0.0\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-19T22:17:21.000000Z"} 2021-11-19T22:17:21+00:00