CVE-2026-81922 Overview
CVE-2026-81922 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions before 9.5.3. The flaw exists in the sitemap Explore dashboard controller, which handles page reordering operations. The send_to_top and send_to_bottom reorder tasks perform only a generic sitemap-access check before executing. An authenticated user with sitemap access can invoke these tasks against any page referenced by the cNodeID parameter without holding move or arrange permissions on that specific page. The result is that a low-privileged user can alter the site's global navigation order.
Critical Impact
Authenticated users with sitemap access can reorder any page in the site tree, bypassing per-page permission checks and modifying global navigation without authorization.
Affected Products
- Concrete CMS versions prior to 9.5.3
- Concrete CMS sitemap Explore dashboard controller
- Deployments exposing sitemap access to non-administrative authenticated users
Discovery Timeline
- Vulnerability reported by Andrew Gonzalez to the Concrete CMS security team
- 2026-09-15 - CVE-2026-81922 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-81922
Vulnerability Analysis
The vulnerability resides in the sitemap Explore dashboard controller that services page-reorder actions. Two reorder tasks, send_to_top and send_to_bottom, execute after only a coarse sitemap-access authorization check. The controller then loads the page identified by the attacker-supplied cNodeID request parameter and mutates its display order. It never verifies that the acting user holds the move or arrange permission on that specific page.
Because the check is applied at the dashboard level rather than the object level, any authenticated user who can reach the sitemap inherits the ability to reorder pages they have no editorial rights over. The impact is limited to page ordering within the navigation tree; content, ownership, and permissions on the affected pages remain unchanged. The Concrete CMS security team assigned a CVSS v4.0 base score of 2.1, reflecting limited integrity impact and no confidentiality or availability effect.
Root Cause
The root cause is a missing per-object authorization check [CWE-862]. The controller enforces a coarse-grained gate for sitemap access but omits the fine-grained check that would confirm the authenticated principal holds move or arrange permission on the target page before applying an ordering change.
Attack Vector
Exploitation requires an authenticated account with high privileges relative to sitemap access but no editorial permission on the target page. The attacker sends a crafted HTTP request to the sitemap Explore dashboard controller, invoking the send_to_top or send_to_bottom task with the cNodeID parameter set to the target page identifier. The controller loads the page and rewrites its display order in the navigation hierarchy. No user interaction on the victim side is required. See the ConcreteCMS Release Notes 9.5.3 for the vendor's technical description.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-81922
Indicators of Compromise
- Unexpected reordering of pages within the Concrete CMS sitemap or public navigation menus
- HTTP requests to the sitemap dashboard controller invoking send_to_top or send_to_bottom with a cNodeID value referencing pages outside the requester's editorial scope
- Audit-log entries showing page display-order changes performed by accounts without prior history of editing those pages
Detection Strategies
- Enable and review Concrete CMS activity logging for reorder actions and correlate the acting user against per-page permission assignments
- Baseline the expected sitemap ordering and alert on unauthorized deviations detected during periodic integrity checks
- Inspect web server access logs for POST requests to the sitemap Explore controller endpoints containing the send_to_top or send_to_bottom task identifiers
Monitoring Recommendations
- Forward Concrete CMS application and web server logs to a centralized analytics platform for correlation across user sessions
- Monitor authenticated sessions from accounts that hold sitemap access but limited editorial rights for anomalous dashboard interactions
- Alert on bulk or rapid successions of reorder requests from a single session, which may indicate scripted abuse
How to Mitigate CVE-2026-81922
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later, which enforces per-page authorization on the send_to_top and send_to_bottom tasks
- Audit user accounts that hold sitemap access and remove the privilege from users who do not require it
- Review recent page ordering changes and revert any unauthorized modifications to the navigation tree
Patch Information
Concrete CMS resolved this issue in the 9.5.3 release. Refer to the ConcreteCMS Release Notes 9.5.3 for the full set of security fixes and upgrade guidance.
Workarounds
- Restrict sitemap dashboard access to trusted administrative roles until the 9.5.3 upgrade is applied
- Apply web application firewall rules that block unauthenticated or unexpected calls to sitemap reorder controller endpoints
- Increase audit log retention and review cadence to identify any reorder actions performed during the exposure window
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
