CVE-2026-18425: IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages
Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated user granted sitemap access could change the display order (cDisplayOrder) of any pages they had no rights to edit, altering the order in which those pages render in navigation, breadcrumb, and page-list output. The reorder action additionally validated no CSRF token, so the write could be triggered by a forged request. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMS 9to a version that resolves this vulnerability.Fixed in 9.5.3 - Compensating control
Mitigate IDOR impact until upgraded by restricting authenticated access to the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) to only trusted users that truly need sitemap reorder capability.
- Compensating control
Mitigate CSRF-based triggering until upgraded by enforcing/ensuring CSRF token validation for any forged requests targeting the dashboard sitemap reorder endpoint (SitemapUpdate::updateDisplayOrder), since the write could be triggered by a forged request and validated no CSRF token in affected versions 9.0.0 through 9.5.2.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Concrete CMS 9 installations before 9.5.3 are affected if an authenticated user has the global access_sitemap task permission. That permission alone was sufficient to reorder pages, including pages the user could not edit.
What can an attacker change?
An authorized sitemap user can change the cDisplayOrder of arbitrary pages. This can alter the order those pages appear in navigation, breadcrumbs, and page-list output, but the provided information does not indicate content modification or disclosure.
Does exploitation require interaction from another user?
Direct exploitation requires an authenticated user with sitemap access. Because the reorder action did not validate a CSRF token, a forged request could also trigger the write action without CSRF protection.
What version fixes the issue?
The issue affects Concrete CMS 9.0.0 through 9.5.2 and is addressed in version 9.5.3.