CVE-2026-81922

Executive Summary

CVE-2026-81922 is a missing authorization vulnerability (CWE-862) in the Concrete CMS sitemap Explore dashboard controller, affecting versions before 9.5.3. The controller's send_to_top and send_to_bottom reorder tasks performed only a generic sitemap-access check and failed to validate that the acting user held move or arrange permission on the specific page identified by the attacker-controlled cNodeID parameter.

An authenticated user who can reach the sitemap but lacks edit/arrange rights on a target page can nonetheless move that page, altering the site's global navigation order. The vendor self-assigned CVSS v4.0 score is 2.1 (LOW), reflecting high privileges required and limited integrity impact — however, navigation-order manipulation can be leveraged for phishing redirection, brand/trust abuse, and targeted content demotion.

Technical Analysis

Vulnerability class: CWE-862 — Missing Authorization. The flaw is an object-level authorization failure (a per-object access control check that is absent), not an authentication bypass.

Attack surface: The Concrete CMS administrative "Explore" dashboard controller that renders and manipulates the site sitemap tree. The sitemap UI issues reorder actions for pages, including the send_to_top and send_to_bottom tasks. These tasks are invoked through HTTP requests carrying a cNodeID parameter that names the target page/sitemap node.

Mechanism: Per the NVD description, the controller enforced only a generic sitemap-access check before executing the send_to_top / send_to_bottom tasks. It then "loaded the page named by the attacker-controlled cNodeID parameter and changed its display order without verifying that the current user held move or arrange permission on that specific page." In other words:

1. Authentication is required (the attacker must be an authenticated user with sitemap access).
2. The check performed is coarse and route-level ("can this user see the sitemap?"), not object-level ("can this user reorder this node?").
3. The missing object-level check permits state change on any node whose identifier is supplied in cNodeID.

Root cause: Authorization decisions were bound to the controller/sitemap feature rather than to the specific target object (the page/node). This is the classic "authorize the action, not the resource" antipattern.

Technical detail limitation: The NVD description does not disclose function names, internal class names, or file paths beyond the task labels send_to_top and send_to_bottom and the parameter cNodeID. No source-level analysis is available from the provided data, and none should be assumed.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available. The following chain is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker obtains a valid low-privilege account that can authenticate to Concrete CMS and reach the sitemap Explore dashboard. The attacker enumerates sitemap node identifiers (the cNodeID values) exposed by the dashboard UI or referenced in page requests. Shodan can be used to fingerprint Concrete CMS deployments via the HTML markers listed above.

2. Triggering the flaw class. With the low-privilege session, the attacker issues the sitemap reorder request for send_to_top or send_to_bottom, supplying a cNodeID corresponding to a page the user is not authorized to move or arrange. Because the controller performs only the generic sitemap-access check, the missing object-level authorization is not detected.

3. Payload/execution at the vulnerability-class level. No code execution payload is involved. The "payload" is the unauthorized state-change request itself: the parameters selecting the reorder task (send_to_top / send_to_bottom) and the target node (cNodeID). The controller loads that node and updates its display order.

4. Post-exploitation impact. The attacker alters the site's global navigation order. Depending on which nodes are moved, this can demote legitimate items, elevate attacker-chosen destinations, disrupt user navigation, and be combined with social engineering (e.g., promoting a page positioned for phishing traffic). No confidentiality or availability impact is indicated; the effect is bounded to ordering/integrity of navigation.

Impact Assessment

CVSS v4.0: 2.1 — CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N.

Subscore interpretation:

• AV:N — remotely reachable over the network.
• AC:L — no special attack complexity.
• AT:P — attack prerequisites are Present (attacker must already be an authenticated, sitemap-reachable user), which caps severity.
• PR:H — High privileges required.
• UI:N — no user interaction required once the request is issued.
• VC:N / VI:L / VA:N — no confidentiality or availability impact; Low integrity impact only.
• SC:N / SI:N / SA:N — no subsequent-system impact.

Blast radius: Confined to sites running Concrete CMS before 9.5.3 where users can reach the sitemap. The blast radius is the site's page-ordering state (global navigation order). For multi-site Concrete deployments, each site's ordering may be affected.

Business impact: Navigation-order tampering is low-severity from a pure CIA perspective but operationally meaningful: it can misdirect customers, undermine information architecture, and be used in brand-abuse / phishing redirection campaigns. EPSS is 0.00229 (13.9th percentile) and there is currently no CISA KEV listing, no public PoC, and no exploit code — near-term mass exploitation is unlikely.

Detection Guidance

Note: The vulnerability does not expose a distinct network signature beyond an authenticated HTTP request to the sitemap reorder endpoint. The rules below target anomalous frequency and sequencing of reorder actions and correlate with authorization semantics. Placeholder names are used only where unavoidable; tune fields to your deployment.

Sigma Rule

title: Concrete CMS Sitemap Reorder Authorization Bypass (CVE-2026-81922)
id: 5b3e7c1a-9f42-4d6e-a8c1-2f0b9d7e4c10
status: experimental
description: Detects repeated sitemap reorder requests (send_to_top / send_to_bottom) that may indicate abuse of missing per-page authorization in Concrete CMS < 9.5.3.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-81922
author: Valters IT Threat Intelligence
date: 2026-06-01
logsource:
  category: webserver
  product: generic
detection:
  selection_task:
    cs-uri-query|contains:
      - 'send_to_top'
      - 'send_to_bottom'
  selection_param:
    cs-uri-query|contains: 'cNodeID'
  timeframe: 5m
  condition: selection_task and selection_param
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
  - cs-username
level: low
falsepositives:
  - Legitimate administrators rearranging site navigation
  - Bulk content reorganization by authorized editors
tags:
  - attack.privilege_escalation
  - attack.t1548
  - cve.2026-81922

YARA Rule

rule CVE_2026_81922_ConcreteCMS_Sitemap_Reorder
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects Concrete CMS sitemap reorder handling referencing send_to_top/send_to_bottom and cNodeID in code/config artifacts in scope of CVE-2026-81922"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-81922"
        date = "2026-06-01"
        severity = "low"
        tlp = "WHITE"

    strings:
        $a = "send_to_top" ascii nocase
        $b = "send_to_bottom" ascii nocase
        $c = "cNodeID" ascii nocase
        $d = "Concrete" ascii nocase
        $e = "concrete5" ascii nocase
        $f = "ccm-page" ascii nocase

    condition:
        uint32(0) != 0x504b0304 and
        (($a and $c) or ($b and $c)) and
        ($d or $e or $f)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-81922 Concrete CMS Sitemap Reorder Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"send_to_top"; nocase; http.uri; content:"cNodeID"; nocase; classtype:attempted-user; reference:cve,2026-81922; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-81922; sid:2026819221; rev:1; metadata:created_at 2026-06-01, affected_product Concrete_CMS, cve CVE-2026-81922;)

alert http any any -> any any (msg:"CVE-2026-81922 Concrete CMS Sitemap Reorder Authorization Bypass Attempt (send_to_bottom)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"send_to_bottom"; nocase; http.uri; content:"cNodeID"; nocase; classtype:attempted-user; reference:cve,2026-81922; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-81922; sid:2026819222; rev:1; metadata:created_at 2026-06-01, affected_product Concrete_CMS, cve CVE-2026-81922;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ url.query : * and url.query : ("send_to_top" or "send_to_bottom") and url.query : *cNodeID* ]
  [ url.query : * and url.query : ("send_to_top" or "send_to_bottom") and url.query : *cNodeID* ]

For environments without url.query normalization, use a simpler aggregation:

any where url.full : * and (url.full : "send_to_top" or url.full : "send_to_bottom") and url.full : *cNodeID*

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower=lower(uri)
| where (like(uri_lower, "%send_to_top%") OR like(uri_lower, "%send_to_bottom%")) AND like(uri_lower, "%cnodeid%")
| rex field=uri "cNodeID=(?<cnode>\d+)"
| stats count min(_time) as first_seen max(_time) as last_seen values(cnode) as nodes by src_ip, user, status
| where count >= 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,concretecms,cve_2026_81922,">
  <rule id="2026819" level="3">
    <if_sid>31100</if_sid>
    <url>send_to_top|send_to_bottom</url>
    <description>CVE-2026-81922: Concrete CMS sitemap reorder request (send_to_top/send_to_bottom) observed</description>
    <group>access_control,authorization_bypass,</group>
  </rule>

  <rule id="2026820" level="8" frequency="5" timeframe="300">
    <if_matched_sid>2026819</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-81922: Repeated Concrete CMS sitemap reorder requests from same source - possible authorization bypass abuse</description>
    <mitre>
      <id>T1548</id>
    </mitre>
    <group>access_control,authorization_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source. The NVD description references the fixed version as Concrete CMS 9.5.3 ("before 9.5.3"), but no tracked patch artifact, vendor advisory URL, commit, or workaround is confirmed in the provided data.

1. Immediate mitigations (pending verified patch):

   • Restrict sitemap/Explore dashboard access to trusted, minimum-necessary accounts; review all users holding generic sitemap access.
   • Apply object-level authorization at the web tier (WAF/reverse proxy) by blocking or rate-limiting send_to_top / send_to_bottom requests whose cNodeID targets pages the session's role should not arrange — where role-to-node mapping is available.
   • Audit and monitor navigation-order changes; snapshot page ordering so unauthorized moves can be detected and reverted.
   • Reduce session privileges for low-trust accounts and consider disabling sitemap reordering for non-administrative roles via configuration.

2. Patch/upgrade steps:

   • Upgrade to Concrete CMS 9.5.3 or later once a vendor-verified release and advisory are available from the project's official channels. Verify the fix actually enforces per-page move/arrange authorization on the target node before relying on it.
   • Because patch confidence from tracked sources is zero, independently validate the release notes/changelog before deploying.

3. Long-term hardening:

   • Enforce resource-scoped authorization checks (object-level) in all state-changing controllers, not just route/feature-level checks.
   • Adopt a central authorization policy that binds actions to the specific target object and the acting user's permission set.
   • Add automated authorization regression tests for reorder/move actions across all roles.
   • Monitor for subsequent changes to navigation ordering and integrate change detection into SOC alerting.

References

• NVD — CVE-2026-81922: https://nvd.nist.gov/vuln/detail/CVE-2026-81922
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• Concrete CMS official project/advisory channel (verify patch status for 9.5.3 before relying on it): https://www.concretecms.org/
• MITRE ATT&CK T1548 — Abuse Elevation Control Mechanism: https://attack.mitre.org/techniques/T1548/
• FIRST EPSS — CVE-2026-81922 (score 0.00229, 13.9th percentile): https://api.first.org/data/v1/epss?cve=CVE-2026-81922

Exploit-in-the-wild / threat actor status: No exploit code, public PoC, or Nuclei template is available. EPSS is 0.00229 (13.9th percentile), indicating low predicted exploitation activity. CVE-2026-81922 is not listed in CISA KEV. No threat actor campaigns are known or reported. Credit for reporting: Andrew Gonzalez (per NVD description).