The vulnerability in Quick.CMS (CVE-2026-63301) involves client-side enforcement of a server-side security control (CWE-602). The administrative interface hides the option to delete the primary language, but the backend API lacks proper authorization checks to prevent this action. Authenticated administrators can bypass the UI restriction by sending direct HTTP requests to delete the primary language, resulting in a denial of service of the application. Additionally, when combined with a separate CSRF vulnerability (CVE-2026-1468), an unauthenticated attacker can cause the denial of service by crafting a malicious link that triggers the deletion when visited by an authenticated administrator. The vendor has assessed the risk as very low and determined no fix is necessary.

Successful exploitation allows an authenticated administrator to delete the primary language, causing a denial of service of the application. Combined with a separate CSRF vulnerability, an unauthenticated attacker can remotely trigger this denial of service without direct access. This impacts application availability.

The vendor has assessed the likelihood of exploitation as very low and determined that a fix is not necessary. No official patch or remediation is currently provided. Users should be aware of the risk but no immediate action is mandated by the vendor.