Executive brief
Concrete CMS, a popular content management system, is vulnerable to a security flaw that could allow an attacker to trick an administrator into performing unintended actions. Specifically, an attacker could cause the system to duplicate calendar events without the user's consent. While this does not directly expose sensitive data, it can be used to clutter the system or disrupt administrative workflows if a logged-in user visits a malicious website.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Concrete CMS versions 9.0.0RC1 through 9.5.0. The issue is located in the 'concrete/controllers/dialog/event/duplicate' component, which fails to properly validate CSRF tokens or implement 'SameSite' cookie attributes correctly. An attacker can exploit this by crafting a malicious webpage that, when visited by an authenticated administrator, triggers a background request to duplicate calendar events. This vulnerability is classified as CWE-352 and CWE-1275. A fix is available in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS 9.0.0RC1 to 9.5.0
Timeline
- 2026-05-21: disclosed: NVD Published Date
- 2026-05-22: advisory: GitHub Advisory published
- 2026-06-24: patched: GitHub Advisory updated with patch information