Concrete CMS in version 9 prior to 9.5.0 has an unprotected CSRF vulnerability in the file approval endpoint. An attacker who can trick an authenticated user into visiting a crafted URL can trigger the approveVersion() action without the user’s knowledge. The impact is limited to actions that the authenticated user is authorized to perform, such as approving a file version, which may lead to unauthorized content changes.

The vulnerability affects Concrete CMS version 9, any installation running a release older than 9.5.0. Administrators should verify the instance’s version and ensure that the system is running 9.5.0 or later.

The CVSS score of 2.3 indicates low overall severity, with no available EPSS score and the issue not listed in CISA KEV. Based on the description, the likely attack vector is a web request directed at an authenticated session; the attack requires a user who has file approval privileges to be tricked into visiting a malicious link. Although the risk is low, the vulnerability can be exploited in environments where the approval feature is used widely or where an attacker can target privileged users.