Concrete CMS version 9 prior to 9.5.0 contains a cross‑site request forgery vulnerability in the addFavoriteFolder controller. An attacker who tricks a logged‑in user into visiting a crafted URL can add a folder to the user’s favorites without authorization. The flaw does not allow code execution or compromise of server credentials, so the impact is limited to unauthorized modification of the user’s preferred items and potential link tracking, resulting in a low severity CVSS score of 2.3.

The affected product is Concrete CMS, any installation of version 9 prior to 9.5.0. The vulnerability is present in the backend file controller addFavoriteFolder action.

Given the CVSS vector AV:N/AC:L/AT:P/PR:N/UI:P, an attacker would need to convince a legitimate user to perform an action in a web browser—typically by inserting a malicious link or form. Exploit probability is likely low, and the EPSS score is not published; CISA KEV does not list this issue. The this low severity and requirement for user interaction means the risk to most deployments is modest, but there is still potential for annoyance and small data integrity impacts.