Concrete CMS 9 before 9.5.0 contains a CSRF flaw in the concrete/controllers/backend/file removeFavoriteFolder($id) endpoint. A malicious actor can craft a request that will delete a user’s favorite folder without the user’s knowledge, compromising data integrity but not exposing confidential data or availability. The weakness is classified as CSRF (CWE‑352) and limits the attacker to actions that the authenticated user is permitted to perform, such as folder deletion.

All releases of Concrete CMS 9 prior to version 9.5.0. The vulnerability resides in the backend file controller that handles the removeFavoriteFolder action. No specific patch versions are listed beyond the recommendation to upgrade to 9.5.0 or newer.

With a CVSS v4.0 score of 2.3 the issue is labeled low severity. No EPSS score is provided, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote and requires the victim to be actively authenticated; a compromised session can be hijacked by a malicious site that forces the victim to issue a removeFavoriteFolder request. Because user interaction is needed, the probability of exploitation is moderate but limited to situations where the user is logged in.