Concrete CMS versions prior to 9.5.3 contain a vulnerability in the Calendar event duplicate dialog controller where an anti-CSRF token was not validated. This flaw allows an authenticated user with permission to add events to create duplicate calendar events via a crafted cross-site request. The issue arises because only access and add-event permissions were checked without CSRF validation.