← CVE Intelligence

CVE-2026-68532

Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action PUBLISHED

Description (CNA)

Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.

Affected (CNA)

Vendor / productVersions
Concrete CMS / Concrete CMSaffected 9.0.0 through 9.5.2

CWE

CWE-352

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.