CVE-2026-81923 Overview
CVE-2026-81923 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions prior to 9.5.3. The flaw resides in the SEO Bulk Update Meta Tags editor, where the saveRecord() action validated the per-page CSRF token but failed to invoke canEditPageProperties() for the target page. Authenticated users with access to the bulk SEO tool could modify meta title, meta description, and URL handle values for pages they were only permitted to view. The result is unauthorized tampering with the presentation and live URLs of otherwise protected content.
Critical Impact
An authenticated user with high privileges to the bulk SEO tool can alter meta tags and URL handles of pages outside their edit scope, affecting content integrity and public-facing URLs.
Affected Products
- Concrete CMS versions prior to 9.5.3
- Concrete CMS SEO Bulk Update Meta Tags editor component
- The saveRecord() handler within the bulk SEO workflow
Discovery Timeline
- Vulnerability reported by Andrew Gonzalez to the Concrete CMS security team
- 2026-09-15 - CVE-2026-81923 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-81923
Vulnerability Analysis
The vulnerability is a broken access control issue in the SEO Bulk Update Meta Tags editor. The saveRecord() action performed only CSRF token validation before writing changes to a target page. It did not confirm that the acting user held edit rights on the specific page being modified. As a result, a user who could view a page but was not granted edit permissions could still change that page's SEO metadata through the bulk tool. The affected fields include meta title, meta description, and URL handle, all of which influence how content is indexed and served publicly. The Concrete CMS security team assigned this issue a CVSS v4.0 score reflecting low integrity impact and no confidentiality or availability impact.
Root Cause
The root cause is a missing authorization check [CWE-862]. The saveRecord() handler validated a per-page CSRF token but never called canEditPageProperties() against the target page. Concrete CMS relies on canEditPageProperties() to enforce per-page edit permissions, and its absence in this code path left the bulk SEO workflow enforcing only session validity rather than object-level authorization.
Attack Vector
Exploitation requires an authenticated account with access to the SEO bulk update tool. The attacker submits a save request through the bulk SEO editor for a page they can view but not edit. Because the handler validates the CSRF token and skips the per-page permission check, the request succeeds. The attacker can then rewrite meta titles, meta descriptions, and URL handles on pages outside their edit scope, altering search-engine presentation and breaking existing URLs. Refer to the ConcreteCMS Version 9.5.3 Release Notes for vendor detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-81923
Indicators of Compromise
- Unexpected changes to page meta title, meta description, or URL handle attributes on pages a user should not be able to edit.
- Audit log entries showing saveRecord() calls from the bulk SEO editor originating from accounts without edit rights on the affected pages.
- Broken inbound links or search results pointing to pages whose URL handle was changed without corresponding change requests.
Detection Strategies
- Correlate page property change events with the acting user's assigned page permissions and flag mismatches.
- Review Concrete CMS version history tables for meta field updates that lack matching workflow approvals.
- Alert on bursts of meta tag or URL handle changes originating from a single account within a short interval.
Monitoring Recommendations
- Ingest Concrete CMS application and web server logs into a centralized log platform for retention and query.
- Monitor HTTP requests to the SEO bulk update endpoints and record the acting user, target page IDs, and outcome.
- Track the population of users granted access to the SEO bulk tool and review membership regularly.
How to Mitigate CVE-2026-81923
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later, which restores the per-page permission check in saveRecord().
- Audit the list of users and groups that hold access to the SEO Bulk Update Meta Tags editor and remove unnecessary grants.
- Review recent page property changes on protected content and revert any unauthorized meta or URL handle edits.
Patch Information
Concrete CMS addressed this vulnerability in version 9.5.3. The fix adds a call to canEditPageProperties() for the target page inside the bulk SEO saveRecord() action, ensuring per-page edit permissions are enforced before any write. See the ConcreteCMS Version 9.5.3 Release Notes for release details.
Workarounds
- Restrict access to the SEO Bulk Update Meta Tags tool to trusted administrators who already have global edit rights.
- Remove the bulk SEO tool grant from roles that hold view-only access to sensitive page trees until the upgrade is applied.
- Enable version history and require workflow approval on protected pages so unauthorized meta changes can be reviewed and rolled back.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
