Concrete CMS IDOR Vulnerability in Express Association Reorder Dialog

An Insecure Direct Object Reference (IDOR) vulnerability combined with improper authorization levels has been identified in Concrete CMS versions 9.5.0 and below. This issue occurs in the Express association Reorder dialog, where it can lead to cross-entity state tampering with view-only permissions on a specific entry. The vulnerability is present on websites using Express and relying on Express entity ordering.

Impact

Exploitation of this vulnerability could result in unauthorized modifications to the state of entities, allowing for cross-entity tampering in Express associations.