CVE-2026-81922 Concrete CMS CVE debrief

Who should care

Concrete CMS site administrators and users with page reordering permissions should verify and limit user permissions to prevent unauthorized page changes. Site administrators should review user roles and ensure that only authorized personnel have the ability to reorder pages. Additionally, users with page reordering permissions should be aware of the potential for unauthorized changes and take steps to monitor and mitigate the vulnerability.

Why it matters

CVE-2026-81922 allows an authenticated user with limited permissions to reorder pages in Concrete CMS before 9.5.3, potentially altering the site's navigation order. Site administrators should verify user permissions and update to Concrete CMS 9.5.3 or later to prevent unauthorized changes.

• An attacker could alter the site's navigation order by moving pages without proper authorization.
• Site administrators need to verify user permissions to prevent unauthorized changes.
• The vulnerability requires an authenticated user with limited permissions to exploit.

Technical summary

The sitemap Explore dashboard controller in Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages, allowing an authenticated user with limited permissions to move pages and alter the site's global navigation order. This vulnerability, reported by Andrew Gonzalez, was given a CVSS v4.0 score of 2.1. The vulnerability requires an authenticated user with limited permissions to exploit. Site administrators should verify user permissions and update to Concrete CMS 9.5.3 or later to prevent unauthorized changes.

Defensive priority

Verify and limit user permissions for page reordering; update to Concrete CMS 9.5.3 or later.

Recommended defensive actions

• Verify user permissions for page reordering in Concrete CMS
• Update to Concrete CMS 9.5.3 or later
• Monitor site navigation and page changes for unauthorized activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS v4.0 score of 2.1 and vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. The vulnerability was reported by Andrew Gonzalez. Concrete CMS site administrators should verify user permissions and update to Concrete CMS 9.5.3 or later. The NVD entry and CVE record offer additional context on the vulnerability's impact and mitigation strategies.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.