Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. (CVE-2026-68532)
Concrete CMS versions up to 9.0.0 have a vulnerability in the dashboard group type controller where the delete action does not validate a CSRF token. This allows a remote unauthenticated attacker to trick an authenticated user with group type management permissions into deleting a custom group type via cross-site request forgery. The vulnerability has a low severity rating based on the CVSS v4.0 score of 2.3.
AI Analysis
Technical Summary
Concrete CMS 9.0.0 and earlier versions contain a CSRF vulnerability in the dashboard group type controller's delete action. The lack of CSRF token validation enables a remote attacker without authentication to induce an authenticated user with appropriate permissions to delete a custom group type. The CVSS v4.0 base score is 2.3, reflecting low impact and requiring user interaction.
Potential Impact
An attacker can cause an authenticated user with group type management permissions to delete a custom group type without their intent, potentially disrupting group configurations. However, the impact is limited by the need for user interaction and specific permissions, resulting in a low severity rating.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users with group type management permissions should be cautious of unsolicited requests and avoid clicking untrusted links that could trigger the delete action.
Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. (CVE-2026-68532)
Description
Concrete CMS versions up to 9.0.0 have a vulnerability in the dashboard group type controller where the delete action does not validate a CSRF token. This allows a remote unauthenticated attacker to trick an authenticated user with group type management permissions into deleting a custom group type via cross-site request forgery. The vulnerability has a low severity rating based on the CVSS v4.0 score of 2.3.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Concrete CMS 9.0.0 and earlier versions contain a CSRF vulnerability in the dashboard group type controller's delete action. The lack of CSRF token validation enables a remote attacker without authentication to induce an authenticated user with appropriate permissions to delete a custom group type. The CVSS v4.0 base score is 2.3, reflecting low impact and requiring user interaction.
Potential Impact
An attacker can cause an authenticated user with group type management permissions to delete a custom group type without their intent, potentially disrupting group configurations. However, the impact is limited by the need for user interaction and specific permissions, resulting in a low severity rating.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users with group type management permissions should be cautious of unsolicited requests and avoid clicking untrusted links that could trigger the delete action.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-f3fv-q5vm-5v62
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-68532"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6aaa07f255bf5e2cf5ea4357
Added to database: 09/16/2026, 03:07:30 UTC
Last enriched: 09/16/2026, 05:00:30 UTC
Last updated: 09/16/2026, 05:00:30 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.