Cross-entity state tampering via under-authorized reorder dialog

Authorization bypass in Concrete CMS 9.5.0 and earlier allows remote authenticated users to alter Express association ordering. The Express association Reorder dialog accepts a user-controlled entry reference and applies cross-entity ordering changes while enforcing only view permission instead of edit authorization. Exploitation requires an Express-enabled site that relies on entity ordering and an account with view-only permission on one entry; the result is unauthorized state tampering, not data disclosure or service interruption.