CVE-2026-18422 Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation
Authenticated users can bypass authorization and CSRF checks to arbitrarily modify multilingual page assignments, altering site language routing.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18422?
CVE-2026-18422 is a low-severity missing authorization vulnerability in Concretecms Concrete Cms, published on 15 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action (Backend\Page\Multilingual::assign). As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a single page could bind an arbitrary page in another locale as that source page's translation, and could delete legitimate translation pairs maintained by other editors, altering public-facing language routing across the site. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
Weakness: CWE-862
Which versions are affected by CVE-2026-18422?
It affects 1 product.
Products include Concretecms Concrete Cms.
How do I fix CVE-2026-18422?
No fix has been published for CVE-2026-18422 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-18422 being exploited?
There is no known exploitation of CVE-2026-18422 in the wild and no public exploit code.
Other vulnerabilities in Concretecms Concrete Cms
- CVE-2023-48648 Concrete CMS allows unauthorized access because directories can be created with insecure permissions
- CVE-2022-21829 Code injection in concrete CMS
- CVE-2021-22958 Server-Side Request Forgery vulnerability in concrete5
- CVE-2021-40098 Path traversal in n/a
- CVE-2026-8134 Concrete CMS Vulnerable to Relative Path Traversal
Sources
Also known as GHSA-hch9-r5fg-6p72.