The vulnerability is a cross‑site request forgery in Concrete CMS that allows a user with edit_file_contents permission to be tricked into publishing a version of a file that they did not choose. This can result in a downgrade to an older file version or the activation of another editor's unpublished version, thus compromising content integrity. The flaw is a classic CSRF weakness identified as CWE‑352.

Affected are installations of Concrete CMS version 9.5.0 and earlier, including the product name Concrete CMS from the vendor Concrete CMS. Users with the edit_file_contents permission are particularly at risk.

The CVSS score of 2.3 indicates low overall severity, yet the flaw can be exploited by coercing an authenticated user into submitting an unnoticed approveVersion request. Because the EPSS score is unknown and the vulnerability is not listed in CISA KEV, the likelihood of widespread exploitation is currently unclear. Nevertheless, the possibility of unauthorized file changes justifies proactive mitigation.