CVE-2026-18425

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3

Description An issue exists in the dashboard sitemap reorder action ConcreteControllerBackendDashboardSitemapUpdate where the system only verifies the global access sitemap task permission and fails to check per-page edit permissions before updating the display order of pages. This allows an authenticated user with sitemap access to modify the cDisplayOrder variable of pages they are not authorized to edit, affecting how these pages appear in navigation, breadcrumbs, and page-list outputs. Additionally, the reorder action does not validate CSRF (Cross-Site Request Forgery) tokens, which could allow the update to be triggered via a forged request.

Recommendations Update to version 9.5.3.