Executive brief
Concrete CMS, a popular content management system, is vulnerable to a security flaw in its bulk page design tool. This vulnerability could allow an attacker to trick an authorized administrator into performing unintended design changes on multiple pages without their consent. While the impact is limited to unauthorized modifications of page layouts or styles, it could be used to deface parts of a website if a logged-in user visits a malicious link.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Concrete CMS versions 9.0.0RC1 through 9.5.0 within the 'concrete/controllers/dialog/page/bulk/design' component. The application fails to properly validate CSRF tokens or implement sufficient SameSite cookie attributes (CWE-1275) for requests to this endpoint. An unauthenticated remote attacker can exploit this by inducing a logged-in administrator to visit a malicious webpage or click a crafted link. Successful exploitation allows the attacker to perform bulk design changes to pages on behalf of the victim. The issue is resolved in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS 9.0.0RC1 to 9.5.0
Timeline
- 2026-05-21: disclosed: NVD Published Date
- 2026-05-22: advisory: GitHub Advisory published
- 2026-06-24: patched: Advisory updated with patch information for version 9.5.1