In Concrete CMS versions 9.x prior to 9.5.0, a Cross‑Site Request Forgery flaw exists at concrete/controllers/dialog/logs/delete. An attacker who successfully tricks an authenticated user into visiting a crafted URL can cause the system to delete log entries. While the vulnerability does not directly expose sensitive data or grant arbitrary code execution, it compromises the integrity of the audit trail and may hinder forensic investigations. The weakness is classified as CWE‑352 and CWE‑1275.

Concrete CMS 9.x versions before 9.5.0, including all releases from 9.0 through 9.4.x. The flaw affects the log deletion dialog controller, which is part of the core Concrete CMS application.

The flaw has a CVSS score of 2.3, indicating a low severity impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires an authenticated session and the victim to open a malicious link, suggesting a user‑interaction attack vector. Because the damage is limited to deleting logs, the overall risk to confidentiality and availability is minimal, and the likelihood of widespread exploitation remains low.