CyberRota Analysis
AI-GeneratedConcrete CMS versions prior to 9.5.3 are susceptible to Cross-Site Request Forgery (CSRF) in the Move Multiple Groups feature, allowing unauthorized group relocations without proper action token validation. This vulnerability can lead to unauthorized permission inheritance for group members, potentially compromising user access controls. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized privilege escalation.
Original NVD Description
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an authenticated user who did not initiate it. Because relocating a group under a new parent causes that group's members to inherit the parent's permissions, a forged move can change effective authorization. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.7 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.