CVE-2026-18425: Missing Authorization

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...