Concrete CMS versions prior to 9.5.0 have an endpoint at concrete/controllers/dialog/page/bulk/cache that does not verify a CSRF token. The flaw enables an attacker to cause the backend to clear cached page data, resulting in functional disruption of cached content. The weakness is categorized as CWE‑352, reflecting missing anti‑CSRF protection.

Concrete CMS 9.x releases earlier than 9.5.0 are affected, including 9.0 through 9.4.x. The issue is fixed in version 9.5.0 and later, so only sites running those older releases need to address the vulnerability.

The CVSS score of 2.3 indicates low overall severity, and the EPSS score is not available, implying a low likelihood of exploitation in the wild. Exploitation is likely to involve an authenticated user, though the CVE description does not explicitly confirm this. Although the vulnerability is not listed in CISA KEV, organizations should still evaluate the risk of exposing a functional endpoint that could be abused for denial‑of‑service or targeted cache manipulation.