Concrete CMS has a session-hardening bypass and allows password change without reauthorization

Concrete CMS 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current password ...