Executive brief
Concrete CMS is a content management system used to build and manage websites. An authenticated user with access to the sitemap dashboard could bypass page-level permission checks to reorder pages in the site's navigation, even if they lack edit or arrange rights on those specific pages. This could allow an attacker to alter the public navigation structure and potentially hide or reorganize critical content.
Technical details
The vulnerability is an authorization bypass in the sitemap Explore dashboard controller. The send_to_top and send_to_bottom reorder tasks performed only a generic sitemap-access check before operating on a page identified by the attacker-controlled cNodeID parameter, without verifying that the authenticated user held move or arrange permission on that specific page. An authenticated attacker with access to the sitemap but lacking edit/arrange rights on target pages can POST requests with a controlled cNodeID to reorder any page in the site hierarchy. The fix is available in Concrete CMS 9.5.3 and later.
Affected products
- Concrete CMS Concrete CMS before 9.5.3
Timeline
- 2026-09-15: disclosed