Concrete CMS versions before 9.5.3 have a vulnerability where the system does not enforce per-page authorization checks when reordering pages via the sitemap. Authenticated users with access to the sitemap but without specific edit or arrange permissions on certain pages could reorder those pages, affecting the site's global navigation order. The vulnerability has a low severity score assigned by the vendor.