CyberRota Analysis
AI-GeneratedConcrete CMS versions prior to 9.5.3 are vulnerable to unauthorized manipulation of page display order by authenticated users with sitemap access, allowing them to reorder pages they do not have permission to edit. This flaw can lead to misleading navigation and breadcrumb structures, potentially impacting user experience and site integrity. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized content manipulation.
Original NVD Description
Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_sitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated user granted sitemap access could change the display order (cDisplayOrder) of any pages they had no rights to edit, altering the order in which those pages render in navigation, breadcrumb, and page-list output. The reorder action additionally validated no CSRF token, so the write could be triggered by a forged request. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.