Concrete CMS versions 9 prior to 9.5.0 contain a cross‑site request forgery flaw in the bulk delete logs controller. An attacker who can trick an authenticated user into visiting a crafted URL can cause that user to delete log entries without authorization, potentially erasing audit trails. The vulnerability is classified as CWE‑352 (Cross‑Site Request Forgery). The flaw does not directly grant arbitrary code execution or data disclosure, but it can degrade the integrity of system logs and hinder forensic investigations.

The affected product is Concrete CMS version 9. Concrete CMS releases the fix in 9.5.0, therefore all installations on version 9 before that release are vulnerable. There is no specific sub‑version number listed beyond the major release 9.5.0 in the vendor information.

The CVSS 4.0 score is 2.3, indicating low severity. EPSS data is not available and the vulnerability is not included in the CISA KEV catalog, suggesting that exploitation is currently unlikely. Exploitation would require the victim to be authenticated to the site and to have permission to delete logs; the attacker would need to lure the user to the malicious URL. No public exploit has been reported, and the low CVSS coupled with the lack of an exploitation vector in the wild reduces the immediate risk but does not eliminate potential abuse.