CVE-2026-81923

Received Received - Intake

SEO Meta Tags Edit in Concrete CMS

Publication date: 2026-09-15

Last updated on: 2026-09-18

Assigner: ConcreteCMS

Description

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties() for the target page, so a user who was granted access to the bulk SEO tool and could view (but not edit) a given page was able to change that page's meta title, meta description, and URL handle outside their edit scope, tampering with the presentation and live URLs of otherwise protected content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-18

Generated

2026-10-06

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-81923

EUVD

EUVD-2026-79294

Affected Vendors & Products

Vendor	Product	Version / Range
concretecms	concrete_cms	to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

In Concrete CMS versions before 9.5.3, the SEO Bulk Update Meta Tags editor had a flaw where it did not verify per-page edit permissions before saving changes. This allowed users with access to the bulk SEO tool but only view permissions on a page to modify that page's meta title, description, and URL handle without proper authorization.

Detection Guidance

This vulnerability can be detected by checking Concrete CMS versions and reviewing access logs for unauthorized changes to meta tags. Ensure the system runs Concrete CMS 9.5.3 or later. Inspect logs for bulk SEO tool usage by users without page edit permissions.

Impact Analysis

This vulnerability could allow unauthorized users to alter the meta information and URLs of pages they do not have edit rights for. This might lead to incorrect or misleading information being displayed in search results or shared links, potentially damaging the site's reputation or user trust.

Compliance Impact

This vulnerability allows unauthorized users to modify meta tags, including URLs and descriptions, which could lead to misrepresentation of content. While not directly violating GDPR or HIPAA, such tampering could compromise data integrity and user trust, potentially impacting compliance with principles requiring accurate data presentation and security.

Mitigation Strategies

Update Concrete CMS to version 9.5.3 or later to address the vulnerability. Ensure that users with access to the SEO Bulk Update Meta Tags editor have the correct per-page edit permissions.

Hi! I’m here to help you understand CVE-2026-81923. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70