Concrete CMS versions older than 9.5.0 contain a Cross Site Request Forgery flaw located at concrete/controllers/dialog/express/association/reorder. The flaw permits an attacker to force a logged‑in user to reorder expressions without the user’s consent, potentially altering site layout or content flow. While the CVSS v.4.0 score of 2.3 indicates a low overall impact, the vulnerability could lead to unauthorized configuration changes within the CMS. The weakness is classified as CWE-1275 and CWE-352.

The affected product is Concrete CMS 9, specifically all releases prior to 9.5.0. No specific patch versions are listed beyond the upgrade to 9.5.0, which includes the CSRF protection fix. Administrators should confirm that the running instance is below 9.5.0 and plan the required upgrade path accordingly.

Because the flaw allows unauthorized action on a state‑changing endpoint, an attacker who can entice a legitimate user into a malicious page can reorder expressions, potentially altering the site layout or content flow. The CVSS score of 2.3 signifies a low severity risk, and with no EPSS score available and no presence in KEV, the likelihood of widespread exploitation appears limited at present. However, the cross‑site nature of the attack means that any user who remains logged in and visits a malicious site poses a risk, particularly on public websites or where users have extensive editing privileges.