CVE-2026-81923 Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor

Low 2.1 Published 15 Sep 2026 Updated 15 Sep 2026

Attackers with bulk SEO tool access can modify meta tags and URLs of pages they cannot edit, bypassing per-page edit permissions.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-81923?

CVE-2026-81923 is a low-severity missing authorization vulnerability in Concretecms Concrete Cms, published on 15 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties() for the target page, so a user who was granted access to the bulk SEO tool and could view (but not edit) a given page was able to change that page's meta title, meta description, and URL handle outside their edit scope, tampering with the presentation and live URLs of otherwise protected content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.

Weakness: CWE-862

Which versions are affected by CVE-2026-81923?

It affects 1 product.

Products include Concretecms Concrete Cms.

How do I fix CVE-2026-81923?

No fix has been published for CVE-2026-81923 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-81923 being exploited?

There is no known exploitation of CVE-2026-81923 in the wild and no public exploit code.

All Concretecms Concrete Cms vulnerabilities

Sources

Also known as GHSA-4q84-hvmx-qpr3.