CVE-2026-81923: Concretecms Concrete CMS

Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days.

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties() for the target page, so a user who was granted access to the bulk SEO tool and could view (but not edit) a given page was able to change that page's meta title, meta description, and URL handle outside their edit scope, tampering with the presentation and live URLs of otherwise protected content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.

Affected products

• Concretecms Concrete CMS: before 9.5.3 (fixed in 9.5.3)

Published 2026-09-15. Last modified 2026-09-18.