CVE-2026-68532

Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to cross-site request forgery (CSRF) in the dashboard group type controller. The delete action did not validate a CSRF token, allowing a remote unauthenticated attacker to trick an authenticated user with group type management permissions i...