---
id: CVE-2026-81923
title: >-
  In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not
  check per-page edit permissions before saving
summary: >-
  In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not
  check per-page edit permissions before saving. The saveRecord() action
  validated the per-page CSRF token but never called canEditPageProperties() for
  the target p…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
vendor: concretecms
product: concrete_cms
affected:
  - concrete_cms < 9.5.3
patched:
  - concrete_cms 9.5.3
published: '2026-09-15'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T15:28:11.123'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81923'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
    label: ff5b8ace-8b95-4078-9743-eac1ca5451de
tags:
  - nvd
  - cve.org
epss: 0.003
epssPercentile: 0.20301
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T19:31:37.558543Z'
scores:
  nvd: 2.7
  cna: 2.1
ingestedAt: '2026-09-15T19:42:58.810Z'
---

## Overview

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties() for the target page, so a user who was granted access to the bulk SEO tool and could view (but not edit) a given page was able to change that page's meta title, meta description, and URL handle outside their edit scope, tampering with the presentation and live URLs of otherwise protected content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.

## Affected

- `concrete_cms < 9.5.3`

## Remediation

Upgrade past the affected range:

- `concrete_cms 9.5.3`