The vulnerability occurs when an administrator supplies the group_id parameter to edit the Anti‑Spam Allowlist Group configuration. The system writes those changes before verifying the CSRF token, allowing the authenticated admin to alter spam filtering settings without the expected CSRF protection. The weakness is a low‑severity CSRF flaw identified as CWE‑352.

All Concrete CMS installations using a version prior to 9.4.8 are affected. There are no stated platform or operating system restrictions; any environment that permits administrative access to the CMS is vulnerable until the patch is applied. The affected functionality is the Anti‑Spam Allowlist Group configuration.

The CVSS v4.0 score of 2.3 indicates a low impact, and the EPSS score of under 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker must first authenticate as an administrator to take advantage of the flaw; they can then change the anti‑spam group settings before the CSRF token is validated. While no public exploit is currently known, the flaw remains active and could permit unauthorized modification of spam filtering rules.