In Concrete CMS 9 versions prior to 9.5.0, an attacker can trigger a Cross Site Request Forgery against the event duplicate controller. The flaw allows the forging of a request to duplicate an event without the user’s explicit consent. The impact is limited to unintended event duplication, which may disrupt scheduling or lead to accidental data redundancy, but it does not provide direct access to sensitive data or code execution. The weakness is identified as CWE‑352 (Cross‑Site Request Forgery) and CWE‑1275 (Use of Unsafe Method for Sensitive Operations).

The vulnerability affects Concrete CMS version 9 prior to 9.5.0. Users running any 9.x release that has not been updated to 9.5.0 or later are considered exposed.

The CVSS v4.0 score of 2.3 reflects a low risk severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, indicating limited exploitation evidence. The likely attack vector would involve persuading a logged‑in, non‑privileged user to click a malicious link or visit a crafted page that triggers the duplicate action. Given the modest CVSS score and absence of publicly documented exploits, the risk profile remains low, though organizations should still verify whether any untrusted users might be able to initiate the duplicate operation.