CVE-2026-18422: Concrete CMS Authorization Bypass Vulnerability

CVE-2026-18422 Overview

CVE-2026-18422 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions before 9.5.3. The flaw resides in the multilingual page assignment backend action Backend\Page\Multilingual::assign. This action fails to enforce a destination-side authorization check and does not validate a Cross-Site Request Forgery (CSRF) token. An authenticated user holding the Edit Page Multilingual Settings permission on a single page can bind arbitrary pages in other locales as translations of that source page. The same user can delete legitimate translation pairs maintained by other editors, altering public-facing language routing across the site.

Critical Impact

An authenticated editor with narrow permissions on one page can manipulate multilingual translation mappings across the entire site, disrupting language routing and integrity of content maintained by other editors.

Affected Products

• Concrete CMS versions prior to 9.5.3
• Concrete CMS multilingual backend component (Backend\Page\Multilingual::assign)
• Sites configured with multi-locale translation routing

Discovery Timeline

• 2026-09-15 - CVE-2026-18422 published to the National Vulnerability Database
• 2026-09-16 - Last updated in NVD database
• Reported to Concrete CMS by Winston Crooker

Technical Details for CVE-2026-18422

Vulnerability Analysis

The vulnerability is a broken access control issue in the multilingual page assignment workflow. Concrete CMS uses a Multilingual add-on to bind pages across locales, letting editors mark one page as the translation of another. The assign backend action accepts a source page and a target page, then updates the translation mapping between them.

The action verifies that the caller holds Edit Page Multilingual Settings on the source page. It does not verify the same permission on the destination page, and it does not require a valid CSRF token on the request. Any authenticated editor who legitimately controls a single page can therefore rewrite translation relationships that touch pages they do not own.

Because translation mappings drive front-end language routing, an attacker can redirect visitors to unintended content in a given locale or unlink legitimate translation pairs. The scope is limited to integrity and availability of the translation graph; the underlying page content is not directly rewritten.

Root Cause

The root cause is missing authorization on the destination object combined with an absent CSRF token check. The Multilingual::assign handler treats source-side permission as sufficient authority for a two-object mutation, violating the principle that both objects in a binding must be independently authorized.

Attack Vector

Exploitation requires an authenticated session with Edit Page Multilingual Settings on at least one page. The attacker submits a crafted request to the multilingual assign endpoint referencing arbitrary destination pages in other locales. The server accepts the mutation without checking destination permission or a CSRF token, and the translation mapping is rewritten or deleted. See the Concrete CMS 9.5.3 Release Notes for the fix reference.

Detection Methods for CVE-2026-18422

Indicators of Compromise

• Unexpected changes in the MultilingualPageRelations table or equivalent translation-mapping records
• Pages appearing as translations of source pages owned by unrelated editors
• Missing or reassigned translation pairs reported by content editors
• HTTP requests targeting the multilingual assign endpoint from accounts with narrow page-level permissions

Detection Strategies

• Enable audit logging on multilingual administration actions and correlate assign events with the acting user's actual permission scope
• Compare translation mapping snapshots between backups to identify unauthorized rebindings
• Alert on POST requests to multilingual backend routes that lack a valid CSRF token header or parameter

Monitoring Recommendations

• Monitor web server access logs for high-frequency requests to Backend/Page/Multilingual/assign from a single authenticated session
• Track editor activity in the Concrete CMS dashboard for translation-pair deletions performed outside a user's assigned page tree
• Review database change logs for edits to translation-mapping tables initiated by low-privilege accounts

How to Mitigate CVE-2026-18422

Immediate Actions Required

• Upgrade Concrete CMS to version 9.5.3 or later on all production and staging sites
• Audit existing multilingual translation pairs and restore any mappings altered by unauthorized users
• Review and tighten the Edit Page Multilingual Settings permission assignments across editor roles

Patch Information

Concrete CMS resolved the issue in version 9.5.3 by enforcing destination-side authorization checks and validating CSRF tokens on the Backend\Page\Multilingual::assign action. Full remediation details are documented in the Concrete CMS 9.5.3 Release Notes.

Workarounds

• Temporarily revoke the Edit Page Multilingual Settings permission from untrusted editor roles until the upgrade is applied
• Restrict access to the multilingual backend routes at the web server or reverse proxy layer to trusted administrator IP ranges
• Increase the frequency of database backups covering translation-mapping tables to enable rapid rollback of unauthorized changes

# Configuration example: verify installed Concrete CMS version
grep -R "APP_VERSION" /path/to/concrete/config/concrete.php
# Expected output after patch: 9.5.3 or later