CVE-2026-18425

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...

CVE-2026-81922

Concrete CMS before 9.5.3 contains a missing authorization flaw in the sitemap Explore dashboard controller . The send_to_top and send_to_bottom reorder actions performed only a generic sitemap-access check before loading a page via the attacker-controlled cNodeID parameter and altering its displ...

CVE-2026-81922 "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-81922

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

EUVD-2026-79292

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...