Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design

Concrete CMS 9 before version 9.5.0 has a weakness that allows attackers to trick users into performing unwanted bulk design changes on pages without their knowledge. An attacker can craft a malicious link that, when clicked by a logged-in CMS user, silently modifies page designs.

CSRF vulnerability in the bulk page design dialog endpoint (concrete/controllers/dialog/page/bulk/design) allows an attacker to forge requests on behalf of authenticated users. Attack requires user interaction (clicking a malicious link) and results in unauthorized modification of page integrity. No authentication token validation is performed on state-changing operations.