Concrete CMS versions 9 prior to 9.5.0 allow a remote attacker to forge requests to the bulk design dialog controller, enabling the attacker to influence the appearance of multiple pages without the user’s consent. The underlying weakness follows CWE‑352 – a lack of proper verification of CSRF tokens – combined with CWE‑1275, which reflects insufficient checks on the user’s authorization level. As a result, an attacker could alter site styling for a subset of pages, but there is no evidence of direct data theft or full control.

Concrete CMS installations running any 9.x release earlier than 9.5.0 are affected. The vulnerability is tied to the controller located at concrete/controllers/dialog/page/bulk/design, which is part of the core package distributed by the CMS vendor.

The CVSS v4.0 score is 2.3, indicating a low overall risk. The EPSS score is not currently available, so the exploitation probability is undetermined. The vulnerability is not listed in the CISA KEV catalog. Attackers would need a user session that has sufficient permissions to invoke the bulk design action; the vector appears to be user‑initiated or an untrusted request that bypasses the CSRF token. Because the impact is limited to design changes, the overall threat remains low but it could be leveraged by a malicious user to subvert branding or phishing attempts.