CVE-2026-68532: Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action
Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
Affected Software
Event History
Frequently Asked Questions
Who can be affected by a CSRF attempt?
An authenticated Concrete CMS user who has permission to manage group types can be targeted. The attacker does not need to authenticate, but must induce that user to perform the request.
What is the impact of successful exploitation?
A successful attack can delete a custom group type. The provided CVSS vector indicates integrity impact is limited and does not indicate confidentiality or availability impact.
Which deployments are affected?
Concrete CMS versions 9.0.0 through 9.5.2 are identified as affected. The issue is in the dashboard group type controller delete action.