Executive brief
Concrete CMS, a content management system used for building websites, is vulnerable to a security flaw that could allow an attacker to trick an administrator into performing unintended actions. Specifically, an attacker could cause a user with the appropriate permissions to approve a file version without their knowledge. This requires the attacker to successfully lure a logged-in administrator to a malicious website or link.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Concrete CMS versions 9.0.0RC1 through 9.5.0. The flaw is located in the `approveVersion()` method within the `concrete/controllers/backend/file` controller. The application fails to properly validate CSRF tokens or implement sufficient SameSite cookie attributes for this specific endpoint. An attacker can exploit this by crafting a malicious webpage that, when visited by an authenticated administrator, triggers a background request to approve a specific file version. This could be used to bypass content review workflows. The issue is resolved in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS >= 9.0.0RC1, < 9.5.1
Timeline
- 2026-05-21: disclosed: NVD publication date
- 2026-05-22: advisory: GitHub Advisory published
- 2026-06-24: patched: Advisory updated with patch information