CVE-2026-81923 in Concrete CMS
Summary
by MITRE • 09/15/2026
In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties() for the target page, so a user who was granted access to the bulk SEO tool and could view (but not edit) a given page was able to change that page's meta title, meta description, and URL handle outside their edit scope, tampering with the presentation and live URLs of otherwise protected content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Concrete CMS versions prior to 9.5.3 represents a critical failure in access control logic within the SEO Bulk Update Meta Tags editor module. This flaw allows users with limited permissions to perform actions that exceed their authorized scope, specifically by modifying metadata for pages they do not have explicit edit rights over. The core technical issue lies in the saveRecord() action of the affected component. While this function correctly implements Cross-Site Request Forgery (CSRF) protection by validating per-page CSRF tokens, it fails to enforce authorization checks regarding page property modifications. Specifically, the code does not invoke the canEditPageProperties() method for the target page before persisting changes. This omission creates a gap where authentication and anti-CSRF measures are satisfied, but role-based access control is bypassed entirely for metadata updates.
From an operational perspective, this vulnerability enables unauthorized modification of critical website elements including meta titles, meta descriptions, and URL handles. These attributes directly influence how content appears in search engine results and social media shares, as well as the structural integrity of site navigation through URL slugs. An attacker who has been granted access to the bulk SEO tool but lacks standard page editing privileges can exploit this flaw to alter these properties for protected pages. This tampering can lead to misleading presentation of content, potential phishing scenarios if URLs are manipulated, and disruption of search engine optimization strategies intended by legitimate administrators. The impact is classified as low severity in terms of confidentiality and integrity loss according to the provided CVSS v4.0 score, primarily because it does not allow for code execution or direct data exfiltration, but it remains a significant administrative security flaw that undermines the principle of least privilege.
This vulnerability aligns with CWE-862, which describes Missing Authorization, as the application fails to enforce proper access controls on sensitive operations. It also relates to CWE-915, Improper Control of Dynamically-Managed Code Resources, insofar as it involves improper control over dynamically generated or managed content properties without adequate validation. In terms of offensive security frameworks, this behavior is consistent with MITRE ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials to perform unauthorized actions due to flawed permission checks. The attack vector requires the user to be authenticated and have access to the specific bulk SEO interface, indicating a horizontal privilege escalation scenario rather than vertical privilege escalation.
Mitigation for this vulnerability involves upgrading Concrete CMS to version 9.5.3 or later, where the saveRecord() function has been patched to include proper authorization checks via canEditPageProperties(). For organizations unable to upgrade immediately, temporary mitigations should focus on restricting access to the SEO Bulk Update Meta Tags editor exclusively to users with full page editing permissions. Additionally, implementing strict role-based access control policies that separate content creation from metadata management can reduce the attack surface. Security teams should also audit existing user roles to ensure that bulk operation tools are not assigned to accounts intended for read-only or limited-editing purposes until the patch is applied.