Threats tagged 'ghsa-rvm5-mg98-27w7'

Concrete CMS 9 versions prior to 9.5.3 allow authenticated users with global sitemap access permission to reorder pages in the dashboard sitemap without verifying per-page edit permissions. This flaw permits changing the display order of pages they cannot edit, affecting navigation and breadcrumb rendering. The reorder action lacks CSRF token validation, enabling potential request forgery. The vulnerability has a low CVSS v4.0 score of 2.1.