Concrete CMS 9.5.2 and earlier versions are vulnerable to CSRF in the Express "Clear Entries" POST endpoint (/index.php/dashboard/system/express/entities/delete_entries). The controller records failed CSRF token checks but does not prevent the operation from proceeding when the token is missing or invalid. This allows a remote unauthenticated attacker to cause an authenticated administrator to delete all entries of an attacker-selected Express entity. The fixed UUID of the default Contact Express object allows the attacker to identify the target entity without dashboard access. The vulnerability has a CVSS v4.0 score of 6.1, indicating a medium severity impact.

An attacker can remotely induce an authenticated administrator to perform destructive actions, specifically deleting all entries of a selected Express entity. This results in permanent data loss for that entity. The attack requires the administrator to visit a malicious page but does not require the attacker to be authenticated. The vulnerability affects data integrity and availability for the affected Express entities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid visiting untrusted or attacker-controlled web pages while authenticated to the Concrete CMS dashboard. Monitor official Concrete CMS channels for updates and patches addressing this CSRF vulnerability.