CVE-2026-18425 in Concrete CMS
Summary
by MITRE • 09/15/2026
Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_sitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated user granted sitemap access could change the display order (cDisplayOrder) of any pages they had no rights to edit, altering the order in which those pages render in navigation, breadcrumb, and page-list output. The reorder action additionally validated no CSRF token, so the write could be triggered by a forged request. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Concrete CMS versions prior to 9.5.3 represents a significant flaw in the application's access control logic, specifically within the dashboard sitemap management functionality. The core issue lies in the implementation of the SitemapUpdate controller class, which handles the reordering of pages within the site structure. While the system correctly enforces global permissions for accessing the sitemap interface via the access_sitemap task permission, it fails to perform granular authorization checks when executing write operations on individual page nodes. This architectural oversight allows any authenticated user with broad sitemap navigation rights to manipulate the structural properties of content they do not own or have edit privileges over. The technical flaw centers on the failure to validate per-page edit permissions before updating the cDisplayOrder attribute, which dictates how pages are sorted in various output contexts such as primary navigation menus, breadcrumb trails, and dynamic page lists.
From a security architecture perspective, this vulnerability is classified under CWE-862, which denotes Missing Authorization, specifically manifesting as an insecure direct object reference or insufficient privilege check during state-changing operations. The attacker does not need to bypass authentication but rather exploits the overly permissive nature of the sitemap access role. By leveraging this elevated permission level, a malicious actor can alter the display order of arbitrary pages within the CMS hierarchy. This manipulation directly impacts the integrity and availability aspects of the system's information presentation layer. Although the vulnerability description notes that confidentiality is not compromised as no sensitive data is exfiltrated, the ability to reorder content without authorization undermines the trustworthiness of the website structure and can be used for defacement or social engineering purposes by altering how links appear to end users.
The operational impact extends beyond simple visual misordering. Because the display order influences navigation elements visible to all visitors, an attacker could potentially promote malicious pages higher in search results within the site's internal indexing or confuse legitimate users by hiding critical information behind less important content. This aligns with ATT&CK technique T1074, Data Staged, if used as part of a larger campaign to hide evidence, though more directly it relates to T1562, Impair Defenses, by disrupting the normal operational presentation of the application. The lack of proper authorization checks means that legitimate administrative workflows relying on accurate sitemap structures can be disrupted, leading to potential business logic errors where users are directed to unintended destinations or unable to find expected resources due to manipulated link hierarchies.
Furthermore, the vulnerability is compounded by a critical absence of Cross-Site Request Forgery protections in this specific endpoint. The reorder action does not validate CSRF tokens, meaning that an attacker can craft malicious requests from other domains or social engineering vectors to trigger these unauthorized changes without requiring additional user interaction beyond clicking a link or loading an image with a hidden request payload. This combination of broken access control and missing anti-CSRF measures significantly lowers the barrier for exploitation, allowing even low-privilege users to perform administrative-like structural modifications remotely. The CVSS v4.0 score of 2.1 reflects the requirement for high privileges (authenticated user) and the lack of impact on confidentiality or system availability in a strict sense, but it underestimates the potential for abuse when combined with social engineering due to the missing CSRF validation.
To mitigate this vulnerability, organizations running Concrete CMS must immediately upgrade to version 9.5.3 or later, where these authorization checks have been corrected to verify per-page edit permissions before allowing any changes to display order. For environments unable to patch immediately, administrators should consider restricting the access_sitemap permission to only those users who genuinely require it for site management, thereby reducing the attack surface of authenticated accounts that could exploit this flaw. Additionally, implementing robust CSRF protection mechanisms across all state-changing endpoints is essential to prevent automated exploitation via forged requests. Regular security audits focusing on granular authorization logic in content management systems are recommended to ensure that global permissions do not inadvertently grant excessive control over individual data objects within the application hierarchy.