Executive brief
Concrete CMS, a popular open-source content management system, contains a cross-site request forgery vulnerability in its group type management interface. An attacker could trick an authenticated administrator into deleting custom group types without their knowledge or consent, disrupting application configuration and user management.
Technical details
The vulnerability is a cross-site request forgery (CSRF) flaw in the dashboard group type controller's delete action. The vulnerable component fails to validate CSRF tokens before processing deletion requests. An unauthenticated attacker can craft a malicious page that, when visited by an authenticated user with group type management permissions, performs an unauthorized delete action. The attack requires user interaction (the victim must visit the attacker-controlled page) and the victim must be authenticated and possess specific group type management privileges. Exploitation results in deletion of custom group types, potentially affecting application configuration and user role management.
Affected products
- Concrete CMS Concrete CMS 9.0.0 and later
Timeline
- 2026-09-15: disclosed