Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. (CVE-2026-81922)
Concrete CMS versions before 9.5.3 have a vulnerability where the system does not enforce per-page authorization checks when reordering pages via the sitemap. Authenticated users with access to the sitemap but without specific edit or arrange permissions on certain pages could reorder those pages, affecting the site's global navigation order. The vulnerability has a low severity score assigned by the vendor.
AI Analysis
Technical Summary
Concrete CMS prior to version 9.5.3 lacks proper per-page authorization enforcement in the sitemap Explore dashboard controller's reorder tasks (send_to_top and send_to_bottom). These tasks only verify generic sitemap access but do not confirm that the user has move or arrange permissions on the targeted page identified by the cNodeID parameter. Consequently, authenticated users with sitemap access but without explicit permissions can reorder pages, altering the site's navigation structure. The vulnerability is tracked as CVE-2026-81922 and has a CVSS v4.0 base score of 2.1.
Potential Impact
An authenticated user with access to the sitemap but without edit or arrange permissions on specific pages can reorder those pages, potentially disrupting the site's navigation order. There is no indication of privilege escalation beyond page reordering or other impacts such as data disclosure or code execution.
Mitigation Recommendations
The vulnerability is fixed in Concrete CMS version 9.5.3. Users should upgrade to version 9.5.3 or later to ensure proper per-page authorization checks are enforced when reordering pages. No other mitigation steps are indicated.
Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. (CVE-2026-81922)
Description
Concrete CMS versions before 9.5.3 have a vulnerability where the system does not enforce per-page authorization checks when reordering pages via the sitemap. Authenticated users with access to the sitemap but without specific edit or arrange permissions on certain pages could reorder those pages, affecting the site's global navigation order. The vulnerability has a low severity score assigned by the vendor.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Concrete CMS prior to version 9.5.3 lacks proper per-page authorization enforcement in the sitemap Explore dashboard controller's reorder tasks (send_to_top and send_to_bottom). These tasks only verify generic sitemap access but do not confirm that the user has move or arrange permissions on the targeted page identified by the cNodeID parameter. Consequently, authenticated users with sitemap access but without explicit permissions can reorder pages, altering the site's navigation structure. The vulnerability is tracked as CVE-2026-81922 and has a CVSS v4.0 base score of 2.1.
Potential Impact
An authenticated user with access to the sitemap but without edit or arrange permissions on specific pages can reorder those pages, potentially disrupting the site's navigation order. There is no indication of privilege escalation beyond page reordering or other impacts such as data disclosure or code execution.
Mitigation Recommendations
The vulnerability is fixed in Concrete CMS version 9.5.3. Users should upgrade to version 9.5.3 or later to ensure proper per-page authorization checks are enforced when reordering pages. No other mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2cmg-3h87-8pjc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-81922"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6aaa07ea55bf5e2cf5ea3d3a
Added to database: 09/16/2026, 03:07:22 UTC
Last enriched: 09/16/2026, 04:59:05 UTC
Last updated: 09/16/2026, 05:01:30 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.