CyberRota Analysis
AI-GeneratedConcrete CMS versions prior to 9.5.3 are vulnerable to a lack of destination-side authorization checks and CSRF token validation in the multilingual page assignment feature. This flaw allows authenticated users with specific permissions to manipulate translation pairs, potentially disrupting language routing and affecting the integrity of multilingual content. Organizations using Concrete CMS should prioritize patching this vulnerability to safeguard their content management processes and maintain site reliability.
Original NVD Description
Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action (Backend\Page\Multilingual::assign). As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a single page could bind an arbitrary page in another locale as that source page's translation, and could delete legitimate translation pairs maintained by other editors, altering public-facing language routing across the site. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.