CVE-2026-81923: Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor
In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties() for the target page, so a user who was granted access to the bulk SEO tool and could view (but not edit) a given page was able to change that page's meta title, meta description, and URL handle outside their edit scope, tampering with the presentation and live URLs of otherwise protected content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3 - Configuration
Update the SEO Bulk Update Meta Tags editor saveRecord() logic to call canEditPageProperties() for the target page so only users with per-page edit permissions can modify meta title, meta description, and URL handle.
Concrete CMS SEO Bulk Update Meta Tags editor Authorization check before saving (per-page permissions) = Ensure canEditPageProperties() is called for the target page before saving changes
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must be granted access to the SEO Bulk Update Meta Tags tool and be able to view the target page. They do not need permission to edit that page's properties.
What changes could an unauthorized user make?
They could change the target page's meta title, meta description, and URL handle. This can alter the page's presentation and its live URL despite the user lacking page-edit permission.
Are installations affected by default?
Exploitation depends on granting a user access to the bulk SEO tool while that user can view pages they are not allowed to edit. The provided information does not establish whether that permission arrangement exists by default.
What version resolves the issue?
Concrete CMS 9.5.3 resolves the missing per-page authorization check. Versions before 9.5.3 are affected.
What can be done before updating?
Restrict access to the SEO Bulk Update Meta Tags tool to users who are authorized to edit every page they can view through it. Review changes to meta titles, descriptions, and URL handles for protected pages.