CVE-2026-18422

Concrete CMS before 9.5.3 contained a vulnerability in the multilingual page assignment backend action (Backend\Page\Multilingual::assign). The action lacked a destination-side authorization check and did not validate a CSRF token . An authenticated user holding only the "Edit Page Multilingual S...

CVE-2026-18422 Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...