CVE-2026-18422: Concrete CMS Authorization Bypass Vulnerability

CVE-2026-18422 Overview

CVE-2026-18422 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions before 9.5.3. The flaw resides in the multilingual page assignment backend action Backend\Page\Multilingual::assign. This action fails to enforce a destination-side authorization check and does not validate a Cross-Site Request Forgery (CSRF) token. An authenticated user holding the Edit Page Multilingual Settings permission on a single page can bind arbitrary pages in other locales as translations of that source page. The same user can delete legitimate translation pairs maintained by other editors, altering public-facing language routing across the site.

Critical Impact
An authenticated editor with narrow permissions on one page can manipulate multilingual translation mappings across the entire site, disrupting language routing and integrity of content maintained by other editors.

Affected Products

Concrete CMS versions prior to 9.5.3
Concrete CMS multilingual backend component (Backend\Page\Multilingual::assign)
Sites configured with multi-locale translation routing

Discovery Timeline

2026-09-15 - CVE-2026-18422 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database
Reported to Concrete CMS by Winston Crooker

Technical Details for CVE-2026-18422

Vulnerability Analysis

The vulnerability is a broken access control issue in the multilingual page assignment workflow. Concrete CMS uses a Multilingual add-on to bind pages across locales, letting editors mark one page as the translation of another. The assign backend action accepts a source page and a target page, then updates the translation mapping between them.

The action verifies that the caller holds Edit Page Multilingual Settings on the source page. It does not verify the same permission on the destination page, and it does not require a valid CSRF token on the request. Any authenticated editor who legitimately controls a single page can therefore rewrite translation relationships that touch pages they do not own.

Because translation mappings drive front-end language routing, an attacker can redirect visitors to unintended content in a given locale or unlink legitimate translation pairs. The scope is limited to integrity and availability of the translation graph; the underlying page content is not directly rewritten.

Root Cause

The root cause is missing authorization on the destination object combined with an absent CSRF token check. The Multilingual::assign handler treats source-side permission as sufficient authority for a two-object mutation, violating the principle that both objects in a binding must be independently authorized.

Attack Vector

Exploitation requires an authenticated session with Edit Page Multilingual Settings on at least one page. The attacker submits a crafted request to the multilingual assign endpoint referencing arbitrary destination pages in other locales. The server accepts the mutation without checking destination permission or a CSRF token, and the translation mapping is rewritten or deleted. See the Concrete CMS 9.5.3 Release Notes for the fix reference.

Detection Methods for CVE-2026-18422

Indicators of Compromise

Unexpected changes in the MultilingualPageRelations table or equivalent translation-mapping records
Pages appearing as translations of source pages owned by unrelated editors
Missing or reassigned translation pairs reported by content editors
HTTP requests targeting the multilingual assign endpoint from accounts with narrow page-level permissions

Detection Strategies

Enable audit logging on multilingual administration actions and correlate assign events with the acting user's actual permission scope
Compare translation mapping snapshots between backups to identify unauthorized rebindings
Alert on POST requests to multilingual backend routes that lack a valid CSRF token header or parameter

Monitoring Recommendations

Monitor web server access logs for high-frequency requests to Backend/Page/Multilingual/assign from a single authenticated session
Track editor activity in the Concrete CMS dashboard for translation-pair deletions performed outside a user's assigned page tree
Review database change logs for edits to translation-mapping tables initiated by low-privilege accounts

How to Mitigate CVE-2026-18422

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later on all production and staging sites
Audit existing multilingual translation pairs and restore any mappings altered by unauthorized users
Review and tighten the Edit Page Multilingual Settings permission assignments across editor roles

Patch Information

Concrete CMS resolved the issue in version 9.5.3 by enforcing destination-side authorization checks and validating CSRF tokens on the Backend\Page\Multilingual::assign action. Full remediation details are documented in the Concrete CMS 9.5.3 Release Notes.

Workarounds

Temporarily revoke the Edit Page Multilingual Settings permission from untrusted editor roles until the upgrade is applied
Restrict access to the multilingual backend routes at the web server or reverse proxy layer to trusted administrator IP ranges
Increase the frequency of database backups covering translation-mapping tables to enable rapid rollback of unauthorized changes

bash

# Configuration example: verify installed Concrete CMS version
grep -R "APP_VERSION" /path/to/concrete/config/concrete.php
# Expected output after patch: 9.5.3 or later