CVE-2026-68532

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.0.0

Description The dashboard group type controller fails to validate a CSRF (Cross-Site Request Forgery) token during its delete action. This allows a remote unauthenticated attacker to trick an authenticated user who possesses group type management permissions into deleting a custom group type.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.