Concrete CMS versions 8.3.0 to 9.5.2 improperly handle calendar event names by storing them without sanitization and rendering them without HTML escaping in workflow approval and deletion notifications displayed in the dashboard's "Waiting For Me" block. This stored XSS vulnerability allows a registered user with event creation privileges to inject script payloads that execute in an administrator's browser when viewing pending requests. Exploitation can lead to privilege escalation, including creating a new administrator account. The vulnerability is tracked as CVE-2026-18116 and has a CVSS v4.0 score of 7.3 (AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

Successful exploitation allows an attacker with event creation permissions to execute arbitrary JavaScript in the context of an administrator's browser. This can lead to privilege escalation, including the creation of new administrator accounts, compromising the integrity and control of the CMS environment. The vulnerability affects the workflow approval and deletion notification processes, exposing administrators to malicious script execution when reviewing pending calendar events.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict calendar event creation permissions to trusted users only and monitor for suspicious activity related to event names. Avoid displaying untrusted input in administrative interfaces without proper sanitization or escaping.