Concrete CMS versions prior to 9.5.3 have a Cross-Site Request Forgery (CSRF) vulnerability in the theme page-template activation feature. The vulnerability allows an attacker to create theme page-template records by sending a forged POST request that lacks proper anti-CSRF token validation. This action can be triggered when a signed-in administrator visits a malicious page, causing unauthorized changes to site configuration without the administrator's consent. The vulnerability has a low severity rating with a CVSS v4.0 score of 2.1.