Executive brief
Concrete CMS, a popular open-source content management system, contains a cross-site request forgery (CSRF) vulnerability in its Express entity management feature. An attacker can trick an authenticated administrator into deleting all entries from an Express entity (such as contact form submissions) by luring them to a malicious webpage. This could result in permanent loss of critical business data without the administrator's knowledge or consent.
Technical details
The vulnerability is a CSRF issue in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries) where the application records but does not enforce CSRF token validation, allowing destructive operations to proceed with missing or invalid tokens. Attack requires the target to be an authenticated administrator who visits an attacker-controlled page, but no special privileges are needed to identify the default Contact Express entity UUID for exploitation. An attacker can force permanent deletion of all entries belonging to any Express entity accessible to the administrator. The issue affects Concrete CMS 9.5.2 and below, and patches should be available in subsequent releases.
Affected products
- Concrete CMS Concrete CMS 9.5.2 and below
Timeline
- 2026-09-11: disclosed