CVE-2026-18425 Concrete CMS CVE debrief

Who should care

Concrete CMS administrators and users with sitemap access should assess exposure and update to version 9.5.3 or later to mitigate the vulnerability. Affected operators and security teams should review compensating controls and implement CSRF token validation for sensitive actions. Platform and vulnerability-management teams should prioritize patching and monitoring for exposed assets.

Why it matters

This vulnerability allows an authenticated user with sitemap access to reorder pages they are not authorized to, potentially altering navigation and page output. The low CVSS score indicates a low priority for remediation.

• An authenticated user with sitemap access could alter the display order of pages they were not authorized to edit.
• The lack of CSRF token validation could allow forged requests to trigger the write operation.

Technical summary

The dashboard sitemap reorder action in Concrete CMS 9 before 9.5.3 did not check per-page edit permission, allowing authenticated users with sitemap access to reorder pages they were not authorized to edit. The action also lacked CSRF token validation, which could allow forged requests to trigger the write operation. This vulnerability has a CVSS score of 2.1, indicating a low severity. The vulnerability affects Concrete CMS versions prior to 9.5.3 and requires authentication and sitemap access to exploit. The low CVSS score indicates a low priority for remediation.

Defensive priority

Low priority, as the vulnerability requires authentication and has a low CVSS score of 2.1.

Recommended defensive actions

• Review and update Concrete CMS to version 9.5.3 or later
• Restrict sitemap access to authorized users
• Implement CSRF token validation for sensitive actions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability allows an authenticated user with sitemap access to reorder pages they are not authorized to edit. Evidence is limited to public CVE and NVD records. Defenders should verify affected scope and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.