CVE-2026-81922: "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "
Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the attacker-controlled cNodeID parameter and changed its display order without verifying that the current user held move or arrange permission on that specific page. Because of this, an authenticated user who could reach the sitemap but had no edit or arrange rights on a given page could still move that page and alter the site's global navigation order. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must be able to access the sitemap and invoke the reorder task. The vulnerable behavior applies even if that user lacks move, edit, or arrange permission for the specific page targeted.
What impact can exploitation have?
An attacker can change the display order of arbitrary pages by moving them to the top or bottom. This can alter the site's global navigation order, but the provided CVSS vector indicates no direct confidentiality impact or availability impact.
Are default deployments affected?
The issue requires sitemap access and authenticated privileges, so it is not exploitable by an unauthenticated visitor based on the available information. Whether a particular default role has sitemap access is not specified.
What version resolves the issue?
Concrete CMS 9.5.3 includes the fix. Versions before 9.5.3 are affected according to the provided information.