Concrete CMS versions up to 9.0.0 have a vulnerability in the dashboard group type controller where the delete action does not validate a CSRF token. This allows a remote unauthenticated attacker to trick an authenticated user with group type management permissions into deleting a custom group type via cross-site request forgery. The vulnerability has a low severity rating based on the CVSS v4.0 score of 2.3.