CVE-2026-18422: Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation
Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action (Backend\Page\Multilingual::assign). As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a single page could bind an arbitrary page in another locale as that source page's translation, and could delete legitimate translation pairs maintained by other editors, altering public-facing language routing across the site. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated user with the Edit Page Multilingual Settings permission on at least one page. The attacker does not need permission on the destination page in the other locale.
What can an attacker change?
They can assign an arbitrary page in another locale as a permitted source page's translation. They can also delete legitimate translation pairings maintained by other editors, which can alter public-facing language routing.
Are sites running the fixed release affected?
The issue affects Concrete CMS versions before 9.5.3. Version 9.5.3 is identified as the release containing the fix.
How can administrators assess possible impact?
Review multilingual translation assignments for unexpected pairings, missing legitimate translation pairs, and language-routing changes. Focus on pages where users had Edit Page Multilingual Settings permission but should not have been able to manage translations in other locales.