---
id: CVE-2026-18425
title: >-
  Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action
  (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global
  access_sitemap task permission and did not check per-page edit permission
  before upda…
summary: >-
  Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action
  (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global
  access_sitemap task permission and did not check per-page edit permission
  before upda…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-352
  - CWE-862
vendor: concretecms
product: concrete_cms
affected:
  - 'concrete_cms >= 9.0.0, < 9.5.3'
patched:
  - concrete_cms 9.5.3
published: '2026-09-15'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T17:51:00.470'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18425'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
    label: ff5b8ace-8b95-4078-9743-eac1ca5451de
tags:
  - nvd
  - cve.org
epss: 0.00123
epssPercentile: 0.01766
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-20T00:41:14.648195Z'
scores:
  nvd: 2.7
  cna: 2.1
ingestedAt: '2026-09-15T20:44:02.398Z'
---

## Overview

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_sitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated user granted sitemap access could change the display order (cDisplayOrder) of any pages they had no rights to edit, altering the order in which those pages render in navigation, breadcrumb, and page-list output. The reorder action additionally validated no CSRF token, so the write could be triggered by a forged request. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

## Affected

- `concrete_cms >= 9.0.0, < 9.5.3`

## Remediation

Upgrade past the affected range:

- `concrete_cms 9.5.3`