Concrete CMS versions 9.5.0 and earlier contain an IDOR and incorrect authorization check in the Express association Reorder dialog. An authenticated user with only view permissions on an entry can access the reorder interface and modify the order of entities, thereby altering state across entries that the user should not control. This flaw permits cross-entity state tampering without granting full administrative rights.

The vulnerability affects installations of Concrete CMS 9.5.0 and any lower patch level that use the Express feature for entity ordering. Sites that enable Express association ordering and expose the reorder dialog are susceptible. Other Concrete CMS versions or configurations not relying on Express ordering are not affected.

The CVSS v4.0 score of 2.3 indicates low severity, aligned with privileges needed and impact. No EPSS data is available, but the lack of entry in the KEV catalog suggests limited exploitation activity. Exploit is limited to the web interface, requiring authentication; therefore the attack would be of network type via the Express reorder URL. Because the flaw only grants state‑modification privileges, the risk to confidentiality or availability is minimal, but integrity of entities could be damaged.