CVE-2026-2994

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.4.8

Description Concrete CMS versions prior to 9.4.8 are susceptible to Cross-Site Request Forgery (CSRF) attacks initiated by a malicious administrator. The issue stems from the Anti-Spam Allowlist Group Configuration, specifically through manipulation of the group id parameter. This allows a security bypass, as changes are saved without proper CSRF token verification.

Recommendations Update Concrete CMS to version 9.4.8 or later.