---
id: CVE-2026-81922
title: >-
  Concrete CMS before 9.5.3 did not enforce a per-page authorization check when
  reordering pages from the sitemap
summary: >-
  Concrete CMS before 9.5.3 did not enforce a per-page authorization check when
  reordering pages from the sitemap. In the sitemap Explore dashboard
  controller, the send_to_top and send_to_bottom reorder tasks ran after only a
  generic sitem…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
vendor: concretecms
product: concrete_cms
affected:
  - concrete_cms < 9.5.3
patched:
  - concrete_cms 9.5.3
published: '2026-09-15'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T15:28:38.240'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81922'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
    label: ff5b8ace-8b95-4078-9743-eac1ca5451de
tags:
  - nvd
  - cve.org
epss: 0.003
epssPercentile: 0.20301
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T19:29:49.050799Z'
scores:
  nvd: 2.7
  cna: 2.1
ingestedAt: '2026-09-15T19:42:58.809Z'
---

## Overview

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send_to_top and send_to_bottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the attacker-controlled cNodeID parameter and changed its display order without verifying that the current user held move or arrange permission on that specific page. Because of this, an authenticated user who could reach the sitemap but had no edit or arrange rights on a given page could still move that page and alter the site's global navigation order. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.

## Affected

- `concrete_cms < 9.5.3`

## Remediation

Upgrade past the affected range:

- `concrete_cms 9.5.3`