CVE-2026-18425 Concrete CMS CVE debrief

Who should care

Concrete CMS administrators and users with sitemap access should assess exposure and apply the patch to prevent unauthorized page reordering. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is

Why it matters

This low-severity vulnerability allows authenticated users with sitemap access to reorder pages in Concrete CMS 9 before 9.5.3, potentially affecting navigation and page output. While the CVSS score is low, defenders should still prioritize patching to prevent unauthorized changes.

• An authenticated user with sitemap access could alter the display order of pages they are not authorized to edit.
• The lack of CSRF token validation allows forged requests to trigger the reorder action.

Technical summary

The dashboard sitemap reorder action in Concrete CMS 9 before 9.5.3 did not properly check per-page edit permissions, allowing authenticated users with sitemap access to reorder pages they are not authorized to edit. The action also lacked CSRF token validation, which could allow forged requests to trigger the reorder action. This could alter navigation, breadcrumb, and page-list output. The vulnerability has a CVSS score of 2.1 and vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N.

Defensive priority

Low priority, as the vulnerability requires authenticated access and has a low CVSS score of 2.1.

Recommended defensive actions

• Review and apply the patch from Concrete CMS version 9.5.3 or later.
• Restrict sitemap access to authorized users only.
• Implement CSRF token validation for sensitive actions.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its CVSS score and vector. A source reference from Concrete CMS documentation is also available. The vulnerability allows authenticated users with sitemap access to reorder pages they are not authorized to edit, potentially affecting navigation and page output. Defenders should verify affected scope and apply the patch to prevent unauthorized page reordering. The lack of CSRF token validation allows forged requests to trigger the reorder action, and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.