CVE-2026-18425 Overview
CVE-2026-18425 affects Concrete CMS versions 9 through 9.5.2. The vulnerability resides in the dashboard sitemap reorder action handled by Concrete\Controller\Backend\Dashboard\SitemapUpdate. The controller authorized reorder requests using only the global access_sitemap task permission and did not enforce per-page edit permission before updating each page's cDisplayOrder value. The action also failed to validate a Cross-Site Request Forgery (CSRF) [CWE-352] token, allowing forged requests to trigger writes. An authenticated user with sitemap access can reorder pages they cannot otherwise edit, changing the sequence in which those pages appear in navigation, breadcrumb, and page-list output.
Critical Impact
Authenticated users with sitemap access can alter the display order of any page in the site, and a forged request can trigger the reorder without user interaction.
Affected Products
- Concrete CMS 9.0.x through 9.5.2
- Concrete CMS dashboard sitemap controller (Concrete\Controller\Backend\Dashboard\SitemapUpdate)
- Sites relying on per-page edit permissions to constrain sitemap changes
Discovery Timeline
- Vulnerability reported by Winston Crooker
- 2026-09-15 - CVE-2026-18425 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-18425
Vulnerability Analysis
The flaw combines a missing authorization check with a missing CSRF token validation in the same controller path. The sitemap reorder handler treats the global access_sitemap task permission as sufficient authorization for any reorder write. It never re-checks whether the authenticated user holds edit permission on each individual page being reordered. As a result, a low-privileged editor with sitemap visibility can change cDisplayOrder across the entire site tree.
The integrity impact is limited to display ordering. Page content, permissions, and metadata are not modified. However, reordered navigation can disrupt content discovery, hide important pages below the fold, or promote pages the attacker controls in navigation menus and breadcrumbs.
Root Cause
Two defects contribute to the issue. First, the controller performs a single coarse-grained permission check for the sitemap dashboard task instead of iterating page-level edit permissions before writing each cDisplayOrder update. Second, the reorder endpoint does not require a valid CSRF token, so any state-changing request accepted by the session is honored.
Attack Vector
Exploitation requires an authenticated Concrete CMS account granted the access_sitemap permission. The attacker submits a reorder request to the dashboard sitemap endpoint referencing page IDs they do not own or cannot edit. Because CSRF protection is absent, an attacker can also host a crafted page that submits the reorder request when a higher-privileged sitemap user visits it, using that user's session to reorder pages.
The vulnerability manifests in the reorder handler itself. No proof-of-concept exploit code is published. See the ConcreteCMS Version 9.5.3 Release Notes for the vendor's technical description of the fix.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-18425
Indicators of Compromise
- Unexpected changes to cDisplayOrder values in the Pages table for pages a user should not be able to edit
- Requests to the dashboard sitemap update endpoint originating from cross-origin referers or without an anti-CSRF token
- Sitemap reorder actions performed by accounts whose role grants sitemap access but not page edit rights
Detection Strategies
- Audit web server logs for POST requests to the SitemapUpdate controller and correlate with the acting user's per-page permissions
- Enable Concrete CMS action logging and review sitemap reorder events for accounts that do not hold edit rights on the affected pages
- Compare snapshots of the Pages table cDisplayOrder column against known-good baselines to identify unauthorized reorderings
Monitoring Recommendations
- Alert on any HTTP request to the sitemap dashboard endpoint that lacks a valid session Origin or Referer header matching the site
- Track the volume of reorder operations per user account and flag spikes from non-administrator accounts
- Forward Concrete CMS application logs to a centralized log platform and retain them long enough to reconstruct reorder history
How to Mitigate CVE-2026-18425
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later, which introduces per-page edit checks and CSRF validation for the reorder action
- Review which roles hold the access_sitemap permission and remove it from accounts that do not require sitemap navigation
- Audit recent reorder history and restore cDisplayOrder values for pages that were changed without authorization
Patch Information
Concrete CMS addressed the issue in version 9.5.3. The fix enforces per-page edit permission checks inside the sitemap reorder controller and requires a valid CSRF token on the reorder request. Details are documented in the ConcreteCMS Version 9.5.3 Release Notes.
Workarounds
- Restrict the access_sitemap permission to trusted administrators until the upgrade is applied
- Place the dashboard behind an authenticated reverse proxy or IP allowlist to reduce CSRF exposure from untrusted networks
- Instruct sitemap administrators to log out of the dashboard when not actively working to shorten the window in which a forged request can succeed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
