Executive brief
Concrete CMS, a popular web content management system, contains a flaw in its calendar feature that allows unauthenticated attackers to trick authenticated users into duplicating calendar events without their knowledge. An attacker could craft a malicious webpage that, when visited by a logged-in administrator with event-creation rights, silently duplicates calendar entries, leading to data confusion and potential operational disruption.
Technical details
A cross-site request forgery (CSRF) vulnerability exists in the calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) due to missing anti-CSRF token validation in the submit() action. The vulnerable code checks only canAccess() and per-resource canAddCalendarEvent() permissions, but does not verify the request token, allowing an attacker to craft a malicious cross-site request. An authenticated user with add-event permissions visiting a crafted page can be induced to create duplicate CalendarEvents and CalendarEventVersions records under their own authority. The vulnerability requires user interaction (the authenticated user must visit the attacker's page) and is only exploitable against users with calendar event creation permissions. Concrete CMS 9.5.3 and later versions contain fixes for this issue.
Affected products
- Concrete CMS Concrete CMS before 9.5.3
Timeline
- 2026-09-11: disclosed