Concrete CMS before version 9.5.3 failed to validate an anti-CSRF token in the submit() action of the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php). The controller only checked canAccess() and per-resource canAddCalendarEvent() permissions before duplicating calendar events. This lack of anti-CSRF validation enables an authenticated user with add-event permission to perform cross-site request forgery attacks that duplicate CalendarEvents and CalendarEventVersions under their own authority. The vulnerability has a CVSS v4.0 base score of 5.3 (medium severity).

An authenticated user with permission to add calendar events can exploit this vulnerability to create duplicate calendar events without proper anti-CSRF protection. This could lead to data integrity issues by generating unintended duplicate event records in the system. There is no indication of privilege escalation or remote code execution. The impact is limited to duplication of calendar events under the attacker's own authority.

A fix is available in Concrete CMS version 9.5.3 and later, which includes validation of the anti-CSRF token in the Calendar event duplicate dialog controller. Users should upgrade to version 9.5.3 or later to remediate this vulnerability. No other mitigation steps are indicated.