Concrete CMS version 9.5.0 and earlier expose a missing authorization check in bulk_user_assignment.php. The flaw allows any authenticated user who can reach the bulk user assignment dashboard to add arbitrary email addresses to any group or remove administrators from groups. This results in a privilege escalation that can grant ordinary users full administrative rights. The vulnerability maps to CWE‑863.

The affected product is Concrete CMS. Versions 9.5.0 and all prior releases experience the issue. The vulnerability is present in the core installation of Concrete CMS and does not depend on additional configuration flags beyond the presence of the bulk_user_assignment.php script.

The CVSS v4.0 score of 7.5 indicates a high severity vulnerability. The attack vector is network-based (AV:N) and requires an authenticated local user, which many installations may have due to wide password reuse or weak authentication practices. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, current exploitation risk is uncertain but the high CVSS and the fact that any authenticated user can elevate privileges suggest a medium-to‑high probability of real-world impact. Administrators should treat this as a serious risk until a patch is applied.