CVE-2026-18422

Executive Summary

CVE-2026-18422 is a missing authorization and missing CSRF validation vulnerability in the multilingual page assignment backend action (Backend\Page\Multilingual::assign) of Concrete CMS prior to version 9.5.3. An authenticated attacker holding the Edit Page Multilingual Settings permission on only a single page can abuse this flaw to bind arbitrary pages in other locales as translations of that source page, and can delete legitimate translation pairs maintained by other editors — altering public-facing language routing across the site. Because the missing check is destination-side plus a missing CSRF token, the vulnerability is not trivially remote-unauthenticated, which is reflected in the low CVSS v4.0 score of 2.1 (AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L) and a low EPSS of 0.00372 (30.8th percentile).

Technical Analysis

Concrete CMS is an open-source content management system widely deployed for corporate sites, intranets, and multilingual publisher portals. Its multilingual subsystem maintains a data model of translation pairs, linking a page in a source (e.g., default) locale to a counterpart page in another locale so the platform can route requests to the correct language variant.

The affected entry point is the backend controller action:

Backend\Page\Multilingual::assign

Per the NVD description, this action performs a state-changing operation — assigning a page as the translation of a source page — but it:

1. Does not enforce a destination-side authorization check. Authorization in the Concrete CMS backend model is scoped to a specific page and permission. The vulnerability description states the attacker only needs Edit Page Multilingual Settings permission on a single page. The backend action, however, does not validate that the authenticated user is authorized on the destination page — i.e., the page being bound as a translation — nor that the user has any rights over the translation relationship itself.
2. Does not validate a CSRF token for the assign action. Concrete CMS normally requires a valid CSRF token on backend state-changing requests. The absence of this token check in assign widens the request surface: the request can be forged or replayed and is not protected by the standard anti-CSRF control.

The result is an authorization-scope flaw (CWE-862) combined with a missing anti-CSRF control: a low-privilege, page-scoped operator is able to perform site-level changes to language routing.

Attack surface

• Component: Multilingual page assignment backend action (Backend\Page\Multilingual::assign).
• Authentication: Required (authenticated backend session).
• Authorization required: Only Edit Page Multilingual Settings on one page.
• Trigger type: State-changing POST request to a backend route (no CSRF token required by the vulnerable action).
• Impact class: Integrity (VI:L) and Availability (VA:L) of the multilingual routing relationships. Confidentiality is not affected (VC:N), and there is no downstream cross-site confidentiality or integrity impact (SC:N/SI:N/SA:N).

CVSS v4.0 subscore reading

The low score (2.1) is consistent with a scoped, authenticated, integrity-only flaw rather than a pre-auth RCE. However, that score understates business impact for multilingual publishers: corrupting language routing on a public site can misdirect traffic, break SEO canonicalization, and present the wrong locale to customers.

CWE mapping

• CWE-862 — Missing Authorization. The primary weakness: the assign action fails to enforce an authorization check on the destination (translation) page.

Because no public exploit, Nuclei template, or PoC code was identified at the time of writing, the precise HTTP request format and parameter names for the assign action are not reproduced here. The following exploitation scenario is described at the vulnerability-class level.

Exploitation Scenarios

No public PoC is available. The attack chain below is inferred from the vulnerability class and the NVD description.

Preconditions

• Attacker possesses valid Concrete CMS backend credentials.
• Attacker has Edit Page Multilingual Settings permission on any single page (a low, commonly delegated editorial right in multilingual sites).
• Target runs Concrete CMS < 9.5.3 with the multilingual subsystem enabled and at least two configured locales.

Step 1 — Reconnaissance / target identification Identify the target's Concrete CMS version via standard fingerprinting (/concrete/, page markup, ccm-page classes, favicon). Enumerate locales in use via generated language switchers, hreflang link tags, or locale-prefixed URLs. The attacker needs to know at least one page under their permitted scope and the locale of the page they intend to bind.

Step 2 — Trigger the specific flaw class Authenticate to the backend with the low-privilege account. Navigate to the multilingual settings for the one page the account may edit. Issue a state-changing request to the backend multilingual action (Backend\Page\Multilingual::assign) that lacks a destination authorization check and does not require a CSRF token. Because no CSRF token is validated, the request can be replayed or forged from a browser context that has a valid backend session — enabling a form of cross-site request forgery against the authenticated editor session.

Step 3 — Payload / execution at the class level The malicious operation is an unauthorized binding: choose a source page within the attacker's permitted scope, and specify as its translation an arbitrary page in another locale — one the attacker has no rights to. Separately, the same missing-authorization path permits deleting existing translation pairs maintained by other editors.

Step 4 — Post-exploitation impact

• Public language routing is altered: visitors requesting one locale may be served the wrong language variant.
• Legitimate translation pairs maintained by other editors are destroyed, orphaning content and breaking navigation.
• SEO impact (misrouted hreflang, duplicate/wrong-locale content) and editorial workflow disruption.
• No confidentiality breach and no code execution; SC/SI/SA are all None.

Because AT:P and PR:H apply, this is not a mass-exploitation vector — it is a trusted-insider or compromised-editor integrity abuse, which matches the low EPSS value.

Impact Assessment

• Integrity (VI:L): Arbitrary translation bindings can be created and legitimate translation pairs deleted, changing which page serves which locale.
• Availability (VA:L): Deleting translation pairs can leave locales without valid routing, temporarily breaking a language variant.
• Confidentiality (VC:N / SC:N): No exposure of data.
• Blast radius: Site-local. Requires a backend account with a page-scoped permission. Impact limited to the multilingual page relationships and resulting public routing, not adjacent systems.
• Business impact: For high-traffic multilingual publishers, misdirected language routing damages customer experience, brand trust, and search visibility. For editorial teams, deletion of translation mappings is an integrity incident that may not be obvious until end users reach the wrong locale.

Affected Systems: Self-hosted and managed Concrete CMS installations < 9.5.3 with the multilingual feature active. Systems not using multiple locales are unaffected in practice (no translation pairs to corrupt).

Detection Guidance

Sigma Rule

title: Suspicious Concrete CMS Multilingual Translation Assignment (CVE-2026-18422)
id: 6f3b7c2a-1e9d-4c8b-9a21-cve2026184220
status: experimental
description: Detects backend requests targeting the Concrete CMS multilingual assign action, which lacks destination-side authorization and CSRF validation in versions before 9.5.3.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18422
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/ccm/system/'
      - '/dashboard/'
  selection_action:
    cs-uri-query|contains:
      - 'multilingual'
      - 'assign'
  selection_actor:
    cs-username|exists: true
  condition: selection_method and selection_uri and selection_action and selection_actor
falsepositives:
  - Legitimate editors performing multilingual assignments on pages they are authorized to manage
level: low
tags:
  - attack.t1565.001
  - cve.2026-18422

Note: Because exact endpoint and parameter tokens are not present in the NVD description, this rule matches on the observed action name (assign) and multilingual context and should be tuned to the tenant's actual routing.

YARA Rule

rule CVE_2026_18422_ConcreteCMS_Multilingual_Assign
{
    meta:
        description = "Detects references to the Concrete CMS multilingual assign action affected by CVE-2026-18422"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18422"
        date = "2026-01-01"
        severity = "low"
    strings:
        $cms = "concrete5" ascii nocase
        $cms2 = "Concrete CMS" ascii nocase
        $cls = "Multilingual" ascii
        $act = "assign" ascii
        $perm = "Edit Page Multilingual Settings" ascii nocase
        $trans = "translation" ascii nocase
    condition:
        ($cms or $cms2) and $cls and $act and ($perm or $trans)
}

Intended for scanning response bodies, template artifacts, or log captures that reference the affected multilingual subsystem in vulnerable deployments.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-18422 Concrete CMS Unauthorized Multilingual Translation Assignment Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"multilingual"; http.uri; content:"assign"; http.header; content:"Cookie"; reference:cve,2026-18422; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-18422; classtype:web-application-attack; sid:2026184220; rev:1;)

This signature is intentionally conservative and may require tuning against the tenant's actual multilingual route. It flags POST requests that reference both the multilingual context and the assign action.

Elastic Detection

sequence by user.name, source.ip with maxspan=60s
  [ network where network.protocol == "http" and http.request.method == "POST"
      and (http.request.body.content : "*multilingual*" or url.path : "*multilingual*") ]
  [ network where network.protocol == "http" and http.response.status_code >= 200
      and http.response.status_code < 300 ]

Detects a POST referencing the multilingual subsystem followed by a success response, suggesting an accepted state-changing assignment. Tune user.name/source.ip fields to your ingestion pipeline.

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_query = lower(uri_query)
| where method="POST" AND (uri_query LIKE "%multilingual%" OR uri_query LIKE "%assign%")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as uris values(status) as statuses by clientip, user
| where count > 0
| sort - last_seen

Adjust index/sourcetype/field names to your environment. Intended to surface backend POST activity against the multilingual assign action for a given account and source IP.

Wazuh OSSEC Rule

<group name="web,concretecms,cve-2026-18422,">
  <rule id="2026184" level="6">
    <if_sid>31100</if_sid>
    <field name="url">multilingual</field>
    <field name="url">assign</field>
    <match>POST</match>
    <description>CVE-2026-18422: Possible Concrete CMS unauthorized multilingual translation assignment attempt</description>
    <group>web_application_attack,pci_dss_6.5,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Assumes web access logs are decoded to expose a url field (parent rule ID 31100 typically covers web access log events). Tune the parent if_sid to your decoder.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED per tracked sources. No patch, vendor fix, or workaround is currently recorded in the tracked data. The AFFECTED_VERSION range is < 9.5.3, and patch details reference the 9.5.3 release as the version expected to contain the fix. Treat this as not confirmed patched until a vendor advisory is verified.

1) Immediate mitigations

• Restrict the Edit Page Multilingual Settings permission to the smallest possible set of accounts, at the narrowest page scope. This is the principal compensating control because the flaw is a destination-side authorization gap.
• Enforce CSRF token validation at the reverse proxy / WAF level for backend state-changing POST requests. Because the vulnerable action does not validate a CSRF token, enforcing the control upstream reduces exposure.
• Restrict backend access (/concrete/, dashboard routes) to trusted networks or VPN, and monitor sessions of multilingual editors.
• Audit and snapshot translation pairs (export multilingual mapping data) so corruption can be detected and reverted.

2) Patch / upgrade steps

• Upgrade Concrete CMS to 9.5.3 or later once the release is available and verified against the vendor advisory. Version < 9.5.3 is the tracked affected range.
• Until a verified vendor advisory is issued, do not assume any earlier point release resolves it.
• Re-validate after upgrade: confirm the assign action enforces destination authorization and CSRF tokens.

3) Long-term hardening

• Implement least-privilege editorial roles with page-scoped permissions and periodic access review.
• Add continuous integrity monitoring of multilingual routing (compare expected translation pairs against a baseline).
• Instrument backend state-changing actions with audit logging and alerting on anomalous editors or off-hours changes.
• Apply the principle that every state-changing backend action must validate both CSRF token and destination-side authorization as a code-review checklist item for customizations.

References

1. NVD — CVE-2026-18422: https://nvd.nist.gov/vuln/detail/CVE-2026-18422
2. CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
3. Concrete CMS Security / Release Advisories: https://www.concretecms.org/ (verify the 9.5.3 security release notes directly with the vendor)
4. CVSS v4.0 Specification: https://www.first.org/cvss/v4.0/
5. EPSS — CVE-2026-18422 score 0.00372 (30.8th percentile): https://api.first.org/data/v1/epss

Exploit-in-the-wild status: No public PoC, no Nuclei template, no exploit code, and the CVE is not in CISA KEV. EPSS 0.00372 (30.8th percentile) indicates low short-term exploitation likelihood. No known threat actor campaigns are associated with this CVE at the time of writing.