Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the… (CVE-2026-18425)
Concrete CMS 9 versions prior to 9.5.3 allow authenticated users with global sitemap access permission to reorder pages in the dashboard sitemap without verifying per-page edit permissions. This flaw permits changing the display order of pages they cannot edit, affecting navigation and breadcrumb rendering. The reorder action lacks CSRF token validation, enabling potential request forgery. The vulnerability has a low CVSS v4.0 score of 2.1.
AI Analysis
Technical Summary
Concrete CMS 9 before 9.5.3 authorizes the dashboard sitemap reorder action using only the global access_sitemap task permission, without checking individual page edit permissions. Consequently, authenticated users with sitemap access can alter the display order (cDisplayOrder) of any pages, even those they lack rights to edit, impacting how pages appear in navigation, breadcrumb, and page-list outputs. Additionally, the reorder action does not validate CSRF tokens, allowing the reorder operation to be triggered via forged requests. The vulnerability was assigned a CVSS v4.0 score of 2.1 by the Concrete CMS security team.
Potential Impact
An authenticated user with sitemap access permission can reorder pages they do not have edit rights for, potentially altering the navigation and breadcrumb structure seen by users. This could lead to confusion or misrepresentation of site structure but does not allow direct content modification or data disclosure. The lack of CSRF protection means an attacker could trick an authorized user into performing unwanted reorder actions.
Mitigation Recommendations
A fix is available in Concrete CMS version 9.5.3. Users should upgrade to version 9.5.3 or later to ensure proper permission checks and CSRF protection are enforced for the sitemap reorder action.
Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the… (CVE-2026-18425)
Description
Concrete CMS 9 versions prior to 9.5.3 allow authenticated users with global sitemap access permission to reorder pages in the dashboard sitemap without verifying per-page edit permissions. This flaw permits changing the display order of pages they cannot edit, affecting navigation and breadcrumb rendering. The reorder action lacks CSRF token validation, enabling potential request forgery. The vulnerability has a low CVSS v4.0 score of 2.1.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Concrete CMS 9 before 9.5.3 authorizes the dashboard sitemap reorder action using only the global access_sitemap task permission, without checking individual page edit permissions. Consequently, authenticated users with sitemap access can alter the display order (cDisplayOrder) of any pages, even those they lack rights to edit, impacting how pages appear in navigation, breadcrumb, and page-list outputs. Additionally, the reorder action does not validate CSRF tokens, allowing the reorder operation to be triggered via forged requests. The vulnerability was assigned a CVSS v4.0 score of 2.1 by the Concrete CMS security team.
Potential Impact
An authenticated user with sitemap access permission can reorder pages they do not have edit rights for, potentially altering the navigation and breadcrumb structure seen by users. This could lead to confusion or misrepresentation of site structure but does not allow direct content modification or data disclosure. The lack of CSRF protection means an attacker could trick an authorized user into performing unwanted reorder actions.
Mitigation Recommendations
A fix is available in Concrete CMS version 9.5.3. Users should upgrade to version 9.5.3 or later to ensure proper permission checks and CSRF protection are enforced for the sitemap reorder action.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rvm5-mg98-27w7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18425"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6aaa07e855bf5e2cf5ea3452
Added to database: 09/16/2026, 03:07:20 UTC
Last enriched: 09/16/2026, 04:57:01 UTC
Last updated: 09/16/2026, 22:01:33 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.