CVE-2026-18425

Executive Summary

CVE-2026-18425 is an authorization and CSRF flaw in Concrete CMS 9 (before 9.5.3) affecting the dashboard sitemap reorder action, implemented in Concrete\Controller\Backend\Dashboard\SitemapUpdate. An authenticated user holding only the global access_sitemap task permission can reorder the display order (cDisplayOrder) of pages they have no rights to edit, and the action performs no CSRF token validation. Impact is limited to integrity of navigation ordering (VI:L) with no confidentiality or availability effect; the Concrete CMS security team assigned it a CVSS v4.0 score of 2.1.

Technical Analysis

Concrete CMS separates two distinct concepts in its authorization model: a task permission (a coarse-grained capability, here access_sitemap) and an object-level access control check (whether the acting user may edit a specific page). The SitemapUpdate backend controller in the dashboard honored only the former.

The vulnerable control flow is as follows. A request is routed to Concrete\Controller\Backend\Dashboard\SitemapUpdate. The controller verifies that the session belongs to a user who has been granted the access_sitemap task permission. It then accepts a set of ordered pages and writes each page's cDisplayOrder column. The controller does not call the per-page edit permission check before committing each write. Consequently, any page whose ID appears in the submitted set is reordered regardless of the caller's rights over that page.

Two independent defects compound here:

1. Missing object-level authorization (IDOR-style vertical/horizontal check omission). The access_sitemap permission is treated as sufficient for modifying any page's ordering. The per-page edit authorization that guards other page-modifying actions is never consulted.
2. Missing anti-CSRF validation. The reorder action validated no CSRF token. Because the endpoint authenticates purely via the session cookie, a forged cross-site request from a browser carrying a valid authenticated session triggers the write with no nonce to defeat it. This is why the description assigns CWE-352.

The write target is the cDisplayOrder property, which Concrete CMS uses to sequence pages in navigation menus, breadcrumbs, and page-list output blocks. Therefore, while the change is not a code-execution or data-exfiltration primitive, it is a stored, persistent content-integrity manipulation that survives until an administrator manually resets the ordering.

CVSS v4.0 subscores reflect the narrow impact:

• AV:N — reachable over the network via the dashboard HTTP interface.
• AC:L — no special conditions beyond a valid session.
• AT:P — attack prerequisites present: the attacker must already possess an authenticated account with access_sitemap.
• PR:H — high privileges required; the flaw is not exploitable by an anonymous or low-privileged account.
• UI:N — the attacker does not need a victim to interact (they can act directly); note that the CSRF vector targets the credentialed browser of an authorized user.
• VC:N / VI:L / VA:N — no confidentiality or availability impact; limited integrity impact.
• SC:N / SI:N / SA:N — no impact on subsequent systems.

The base score of 2.1 with the vector above is consistent: a low-impact, high-prerequisite integrity issue.

Note on CSRF relevance. The missing-token defect widens the delivery surface (a forged request succeeds), but the authorization defect (missing per-page check) is what determines the blast radius. A forged request can only reorder pages the session-holding user could already reach in the sitemap UI — but because the per-page check is absent, that set includes pages the user may not edit.

Exploitation Scenarios

No public proof-of-concept exists, and no source code, advisory, or commit diff was provided. The following chain is derived strictly from the NVD description; no function names, endpoints, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies a Concrete CMS 9 installation running a version earlier than 9.5.3 (e.g., via the dashboard login page, static asset paths, or metadata in responses). The attacker requires a foothold: a valid authenticated account that has been granted the access_sitemap task permission. This is a realistic condition for contractor, content-editor, or departmental accounts in larger deployments, and is the crux of the AT:P/PR:H prerequisites.

2. Trigger of the flaw class. Two variants exist per the description:

   • Direct authorization-bypass abuse: The authenticated user opens (or crafts a request against) the dashboard sitemap reorder action handled by Concrete\Controller\Backend\Dashboard\SitemapUpdate. Because the controller checks only access_sitemap, the user submits an ordering that includes page IDs the account cannot edit. Each write is accepted and the cDisplayOrder values of those pages are persisted.
   • CSRF-delivery abuse: Because the reorder action validates no CSRF token, an attacker who can induce an authorized user's browser to issue a request to the reorder action can cause the reorder without the user's knowledge or intent. The user's session cookie supplies authentication; the absent token is the only check that would otherwise stop the forged request.

3. Execution / payload at class level. The "payload" is an ordered list of page identifiers submitted to the reorder action. This is a data-manipulation primitive: a stored write to the cDisplayOrder column. No code execution, file write, or command injection is involved. The attacker is not injecting markup or script — purely reassigning integer ordering values for pages they should not be able to touch.

4. Post-exploitation impact. Affected pages render in a rearranged order across navigation menus, breadcrumbs, and page-list output. Depending on site content this can:

   • Demote, bury, or promote specific pages to manipulate user navigation and attention (content/deception ops).
   • Break or obscure safety, legal, terms-of-service, or compliance pages that are expected to appear in a fixed position in navigation.
   • Cause operational confusion and require administrator remediation to restore intended ordering.

   No data is read, exfiltrated, or destroyed; the impact is bounded to ordering integrity as stated by VI:L.

No public PoC available; attack chain is inferred from the vulnerability class (missing object-level authorization + missing CSRF protection).

Impact Assessment

CVE-2026-18425 has a tightly scoped integrity impact. Per the CVSS v4.0 vector, confidentiality, availability, and subsequent-system impacts are all None; only integrity is affected and only at a Low level (VI:L). The base score is 2.1.

Business impact:

• Navigation/content integrity: An actor with access_sitemap (or an attacker leveraging a forged request into such a session) can silently reorder pages site-wide, altering how visitors experience navigation, breadcrumbs, and page lists. This is a reputational and content-governance risk rather than a data-breach risk.
• Compliance/legal exposure (indirect): If reordering buries legally required notices, disclosures, or safety guidance, downstream regulatory or contractual obligations may be implicated — but this is speculative and depends on site-specific content, so it is a secondary consideration.
• Low exploitability: EPSS is 0.00159 (5.5th percentile), consistent with a high-prerequisite, low-impact bug. No CISA KEV listing, no public PoC, no Nuclei template, and no exploit code are known.

Blast radius: Limited to the Concrete CMS instance and the pages accessible to the attacker's account scope. Because the per-page edit check is missing, the blast radius within the instance extends to any page the attacker's reorder request references — i.e., broader than the account's legitimate edit rights. It does not cross into unrelated systems (SC:N/SI:N/SA:N).

Affected systems: Concrete CMS (a.k.a. concrete5) version 9 installations prior to 9.5.3. Installations on the Concrete 8.x line or on 9.5.3+ are outside the stated range.

Detection Guidance

Detection for this class centers on (a) authorization-anomaly auditing in application logs, and (b) request-pattern monitoring against the sitemap reorder action. Because no CSRF token is validated and no special payload strings are involved, network and endpoint detections must key off the action’s URL, the authenticated session, and the volume/frequency of reorder writes.

Sigma Rule

title: Concrete CMS Sitemap Reorder Without Per-Page Edit Authorization
id: 5f9c2a10-7b4e-4c33-9b21-cve202618425
status: experimental
description: Detects use of the Concrete CMS dashboard sitemap reorder action
  (SitemapUpdate) which may indicate CVE-2026-18425 authorization bypass or
  CSRF-driven reordering of pages the actor cannot edit.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18425
author: valtersit.com
date: 2026-06-01
logsource:
  category: webserver
  product: apache
detection:
  selection_action:
    cs-uri-stem|contains: 'SitemapUpdate'
  selection_method:
    cs-method: 'POST'
  condition: selection_action and selection_method
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate administrators reordering the sitemap as part of normal content workflow
level: low
tags:
  - attack.t1565.001
  - cve.2026.18425

YARA Rule

rule CVE_2026_18425_Concrete_CMS_SitemapUpdate_Indicators
{
    meta:
        author = "valtersit.com"
        description = "Detects references to the Concrete CMS SitemapUpdate controller and the cDisplayOrder property in web/log artifacts; supports CVE-2026-18425 triage."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18425"
        date = "2026-06-01"
        severity = "low"

    strings:
        $ctrl = "Concrete\\Controller\\Backend\\Dashboard\\SitemapUpdate" ascii wide nocase
        $ctrl2 = "SitemapUpdate" ascii nocase
        $field = "cDisplayOrder" ascii wide nocase
        $perm = "access_sitemap" ascii wide nocase

    condition:
        (uint16(0) == 0x3C3F or uint32(0) == 0x504B0304 or filename matches /\.(php|log|txt|json)$/) and
        (any of ($ctrl*) or ($field and $perm))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-18425 Concrete CMS Sitemap Reorder Action (SitemapUpdate) Accessed"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"SitemapUpdate"; nocase; http.header; content:"Cookie"; nocase; reference:cve,2026-18425; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-18425; classtype:policy-violation; sid:20261842501; rev:1; metadata:created_at 2026_06_01, updated_at 2026_06_01;)

Elastic Detection

sequence by user.name, source.ip with maxspan=2m
  [ network where http.request.method == "POST"
      and url.path : "*SitemapUpdate*" ]
  [ network where http.request.method == "POST"
      and url.path : "*SitemapUpdate*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri = coalesce(uri, cs_uri_stem)
| where like(uri, "%SitemapUpdate%") AND method="POST"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(status) as status_codes
        by src_ip, user, uri
| where count >= 2
| eval first_seen = strftime(first_seen, "%Y-%m-%d %H:%M:%S"),
       last_seen  = strftime(last_seen,  "%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,concrete_cms,cve_2026_18425,">
  <rule id="202618425" level="4">
    <if_sid>31100</if_sid>
    <id>^40[0-9]</id>
    <match>SitemapUpdate</match>
    <description>CVE-2026-18425: Concrete CMS sitemap reorder action accessed (SitemapUpdate) - possible authorization bypass or CSRF-driven reorder.</description>
    <group>cve_2026_18425,t1565_001,</group>
  </rule>

  <rule id="202618426" level="7">
    <if_sid>202618425</if_sid>
    <match>SitemapUpdate</match>
    <description>CVE-2026-18425: Repeated Concrete CMS sitemap reorder activity detected - investigate for unauthorized cDisplayOrder modification.</description>
    <group>cve_2026_18425,t1565_001,</group>
  </rule>
</group>

Note: These detections key on the SitemapUpdate action name and authenticated POST pattern from the NVD description. Because the flaw involves no unique payload string, they will fire on legitimate administrator reordering; tune using user and frequency.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

The NVD description names Concrete CMS 9.5.3 as the version boundary ("9 before 9.5.3"), but no vendor advisory, commit, tag, or patch reference was supplied by any tracked source, so treat 9.5.3 as an unverified target until a vendor advisory confirms it. No OSV package fix is recorded (state: unfixed).

1. Immediate mitigations (no patch required):

   • Restrict the access_sitemap task permission. Audit which users/groups hold it and revoke it from contractor, editor, and departmental accounts that do not require full sitemap control. This directly removes both the direct-abuse and CSRF-abuse prerequisites (AT:P, PR:H).
   • Add token enforcement at the edge. Where possible, enforce a per-session anti-CSRF check via a reverse proxy/WAF rule on the reorder action, or apply a SameSite=Strict/Lax cookie policy so session cookies are not sent on cross-site forged requests. SameSite hardening blunts the CSRF variant independently of the app defect.
   • Monitor and baseline page ordering. Take a snapshot of navigation/page ordering and alert on unexpected changes to detect either variant.

2. Patch / upgrade steps:

   • Upgrade to Concrete CMS 9.5.3 only after independently verifying the vendor advisory and changelog confirm the fix (per-page edit permission check added and CSRF token enforced on Concrete\Controller\Backend\Dashboard\SitemapUpdate). No verified patch artifact exists in the data provided; do not treat this report as confirmation of the fix contents.
   • Until a patch is confirmed, apply the mitigations above and track the vendor's security announcements.

3. Long-term hardening:

   • Enforce object-level authorization on every mutation: never rely on a coarse task permission as a substitute for per-object edit checks. Adopt a framework-level "authorize, then act" pattern.
   • Enable CSRF protection by default and make it a mandatory middleware for all state-changing dashboard actions.
   • Apply least-privilege role design so that sitemap access is a narrow, audited capability.
   • Maintain integrity monitoring over content structure (ordering, menu trees) so low-severity integrity tampering is still visible.

References

• NVD — CVE-2026-18425: https://nvd.nist.gov/vuln/detail/CVE-2026-18425
• Concrete CMS security advisories / release notes (verify 9.5.3 fix contents directly with the vendor): https://www.concretecms.org/
• CWE-352: Cross-Site Request Forgery (CSRF): https://cwe.mitre.org/data/definitions/352.html
• MITRE ATT&CK T1565.001 — Stored Data Manipulation: https://attack.mitre.org/techniques/T1565/001/
• FIRST — CVSS v4.0 specification: https://www.first.org/cvss/v4.0/

Exploit-in-the-wild & threat actor evidence: None. CISA KEV: NO. No public PoC, no Nuclei template, and no exploit code were identified. EPSS is 0.00159 (5.5th percentile), indicating low predicted exploitation activity. No threat actor campaign is associated with CVE-2026-18425 in the available data. The vulnerability was reported by Winston Crooker.