CVE-2026-18425

Concrete CMS 9 (versions 9.0.0 through 9.5.2) contains an IDOR flaw in the dashboard sitemap reorder action (SitemapUpdate::updateDisplayOrder). The controller checks only the global access_sitemap task permission and omits any per-page edit permission check, allowing an authenticated user with s...