Threats tagged 'ghsa-hch9-r5fg-6p72'

Concrete CMS versions before 9.5.3 have a vulnerability in the multilingual page assignment backend action where destination-side authorization checks and CSRF token validation were not enforced. This flaw allows an authenticated user with the Edit Page Multilingual Settings permission on a single page to bind arbitrary pages in other locales as translations or delete legitimate translation pairs, impacting language routing on the site. The vulnerability has a low severity rating with a CVSS v4.0 score of 2.1.