EUVD-2026-79504

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...

CVE-2026-18425

Concrete CMS 9 (versions 9.0.0 through 9.5.2) contains an IDOR flaw in the dashboard sitemap reorder action (SitemapUpdate::updateDisplayOrder). The controller checks only the global access_sitemap task permission and omits any per-page edit permission check, allowing an authenticated user with s...

CVE-2026-81922

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-81922

Concrete CMS before 9.5.3 contains a missing authorization flaw in the sitemap Explore dashboard controller . The send_to_top and send_to_bottom reorder actions performed only a generic sitemap-access check before loading a page via the attacker-controlled cNodeID parameter and altering its displ...