CVE-2026-84432
Deferred Deferred - Pending Action

CSRF in Concrete CMS Board Slot Dialog

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: ConcreteCMS

Description
Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller (concrete/controllers/dialog/board/custom_slot.php) saveTemplate() action. The action created a board_slot_proxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while gating only on the per-resource canEditBoardContents() permission, so a crafted cross-site request could cause a user holding board-edit permission with an active session to write attacker-chosen slot and template data to a board under their own authority. The state-changing database write completed before any downstream rendering, so the forged request succeeded even when the HTTP response returned a non-200 status. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-11
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-84432
EUVD
EUVD-2026-75706

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms From 9 (inc) to 9.5.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Concrete CMS versions 9 through 9.5.2 had a vulnerability where the Boards custom slot dialog controller did not validate an anti-CSRF token in the saveTemplate() action. This allowed attackers to send crafted cross-site requests that would write malicious slot and template data to a board under the victim's authority, bypassing proper security checks.

Detection Guidance

This vulnerability involves a missing anti-CSRF token validation in Concrete CMS versions 9 through 9.5.2. To detect it, inspect the Boards custom slot dialog controller file at concrete/controllers/dialog/board/custom_slot.php for the saveTemplate() action. Check if the action lacks CSRF token validation before processing requests. Review server logs for suspicious POST requests to this endpoint without valid session tokens.

Impact Analysis

If you use Concrete CMS versions 9 through 9.5.2, an attacker could trick you into clicking a malicious link while logged in, allowing them to modify board content without your knowledge. This could lead to unauthorized changes in your website's layout or functionality.

Compliance Impact

This vulnerability allows unauthorized modification of board slot and template data through crafted cross-site requests. While not directly violating GDPR or HIPAA, it could lead to unauthorized data changes or access if exploited in systems handling regulated data. The lack of CSRF protection undermines integrity controls required by these standards.

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or later to address the anti-CSRF token validation issue in the Boards custom slot dialog controller.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84432. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart