Concrete CMS 9 versions earlier than 9.5.0 allow an attacker to send a forged request to the bulk delete page endpoint, potentially deleting site pages without the user’s intent. This Cross‑Site Request Forgery weakness does not directly grant execution privileges but can lead to accidental data loss or site disruption. The severity is rated low with a CVSS v4.0 score of 2.3, reflecting that the exploit requires an authenticated user to be tricked into visiting the malicious URL and that the impact is limited to the targeted pages.

The vulnerability affects all releases of Concrete CMS 9 up to, but not including, 9.5.0. Users running any 9.x version should verify their installed patch level and upgrade if necessary.

The risk is moderate because the vulnerability needs user interaction and there is no automated exploitation vector. The EPSS score is currently unavailable, but the lack of listing in the CISA KEV catalog suggests low exploitation pressure. Attackers would likely craft a malicious link or form that forces an authenticated administrator or content editor to execute the bulk delete operation, resulting in unwanted content removal.