Concrete CMS versions before 9.5.3 contain a flaw in the backend multilingual page assignment action. The system neither verifies the destination page’s authorization status nor validates a CSRF token. An authenticated user who has the Edit Page Multilingual Settings permission on a single page can therefore bind any page in another locale as a translation of that source page, or delete existing valid translation pairs. This capability can alter the public‑facing language routing on the site and disrupt content consistency, although it does not directly expose data or crash the system.

All Concrete CMS installations running a version earlier than 9.5.3 are affected. The vulnerability exists in the multilingual assignment feature of the CMS backend, so any deployment that has enabled multilingual support and has pages with Edit Page Multilingual Settings permission granted to users is at risk.

The CVSS v4.0 score of 2.1 indicates a low overall severity, and the EPSS score is not available in the data set. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated session and the presence of Edit Page Multilingual Settings permission, meaning only users who already hold some managerial privileges can exercise the flaw. The lack of a CSRF check makes the attack straightforward from a user’s own browser, but the limited permission scope reduces the likelihood of widespread abuse.