Adobe Experience Manager Sites & More

test1234567 · 10/21/25

Hello Community,

We're encountering an issue affecting a specific user group. These users already have Read, Modify, Create, and Delete permissions for the page. They can edit and update components authored on the page and add new components as well. However, when trying to update the page properties, none of the fields or tabs in the page properties are editable. When attempting to save the page, the users receive the following error:

org.apache.sling.api.resource.PersistenceException: Unable to commit changes to session.

This issue does not occur for admin users. Granting additional ACL privileges resolves the issue, but we are not supposed to grant such permissions to this group. Additionally, users are able to update the page properties of child pages without any issues, and those child pages use the same template and permissions. The root page is not locked, and users with the same permission level have previously been able to update the page without any problems.

Can someone advise what could be causing this issue? Would copying the same page to a lower environment help in troubleshooting? Do we need to enable any additional debug logs to investigate further? I tried to enable logs for org.apache.sling.api.resource.PersistenceException, but 'resource.PersistenceException' is not available for log configuration. Should I try adding any additional packages to assist in debugging this issue?

Page JSON:

{
"jcr:primaryType": "cq:PageContent",
"jcr:mixinTypes": [
"mix:lockable",
"mix:versionable"
],
"jcr:createdBy": "admin",
"jcr:title": "Test Root Page",
"cq:lastReplicationAction": "Activate",
"jcr:versionHistory": "dc84b5ea-747f-4a35-840a-30bc6b0e3c3c",
"cq:template": "/conf/test/settings/wcm/templates/test-template",
"cq:lastReplicatedBy": "workflow-process-service",
"assetSubSection": "",
"jcr:language": "en_us",
"modifiedDate": "2025-10-09T05:33:45",
"jcr:predecessors": [
"f4015987-536a-4545-b2b0-2766e31070f2"
],
"jcr:created": "Tue Apr 23 2024 00:02:11 GMT+0000",
"cq:lastReplicated": "Wed Oct 15 2025 03:00:32 GMT+0000",
"cq:lastModified": "Thu Oct 16 2025 20:01:21 GMT+0000",
"cq:cloudserviceconfigs": [
"/etc/cloudservices/test/config"
],
"jcr:description": "Test Description",
"jcr:baseVersion": "f4015665-536a-4545-b2b0-2766e31070f2",
"pageTitleUms": "Test",
"jcr:isCheckedOut": true,
"disablebydefault": "false",
"pageTitle": "Test Product",
"cq:skippedPages": [],
"jcr:uuid": "2200817c-fb84-45e6-8b99-dcd96b473ecc",
"sling:resourceType": "test/components/page/layout",
"textIsRich": "true",
"cq:premodernizeVersion": "33410e1b-42a1-4e44-ae9b-534bf425cf45",
"cq:lastModifiedBy": "test@test.com,
"navTitle": "ROOT PAGE",
"root": {
"jcr:primaryType": "nt:unstructured",
"sling:resourceType": "wcm/foundation/components/responsivegrid",
"responsivegrid": {
"jcr:primaryType": "nt:unstructured",
"jcr:mixinTypes": [
"cq:ReplicationStatus"
],
"jcr:createdBy": "admin",
"jcr:lastModifiedBy": "admin",
"jcr:created": "Tue Aug 23 2022 09:24:43 GMT-0500",
"jcr:lastModified": "Fri Sep 05 2025 17:22:05 GMT+0000",
"sling:resourceType": "wcm/foundation/components/responsivegrid",
"layout_container_cop": {
"jcr:primaryType": "nt:unstructured",
"jcr:mixinTypes": [],
"jcr:createdBy": "lburg",
"internalMarginHorizontal": "none",
...........
}
}
}
}

@aanchal-sikka

@davidjgonzalezzzz @EstebanBustamante @RiteshY18 @Gokul_Agiwal @Umesh_Thakur @pradnya_balvir @Amelia_Waliany @ParitMittal @pradnya_balvir
@Umesh_Thakur @AmitVishwakarma @HrishikeshKagne

VishalKa5 · 10/22/25

Hi @test1234567 ,

This issue happens because the user group is missing some required permissions on hidden system nodes linked to the page, even though they already have read, modify, create, and delete rights. When they try to save page properties, AEM also updates things like locks, version history, or cloud service configs, and without access to those nodes, the save fails with “Unable to commit changes.” Admins don’t face this issue because they have full access, and child pages work because they don’t reference those extra configurations. The solution is to add minimal permissions like lock management and node type management on the page and read access to related paths like /conf and /etc/cloudservices. No need to give full admin rights. Debug logs can help identify the exact missing permission if needed.

Thanks & Regards,

Vishal

test1234567 · 10/22/25

Thanks for your reply. Regarding locks and version history permissions, do we need to grant permissions to any specific paths, and what kind of permissions are required? For example, is only Read permission sufficient, or are additional permissions needed? Also, based on the error, should we enable any logs for a specific package to help troubleshoot the issue further?

VishalKa5 · 10/22/25

Hi @test1234567 ,

Yes, you will need to give a few specific permissions in addition to the normal read and write access on the page. When a user saves page properties in AEM, the system may also need to create a version, update locks, or read template and cloud configurations linked to that page. So, you should give the group lock management permission on the page path so they can lock and unlock the page, and read access to version history and configuration paths like /var/versions (or /jcr:system/jcr:versionStorage in on-prem), /conf, and /etc/cloudservices. Read access is enough for those system paths, and only the page path needs modify and lock permissions. To troubleshoot this further, you can enable debug logs for Oak security and access control to see exactly which permission is missing during the failure. These logs will clearly show what is being blocked so you can fix it quickly without giving full admin rights.

Thanks & regards,

Vishal

test1234567 · 11/2/25

Thank you for your reply. I have enabled debug logs for the package listed below, but I couldn’t obtain detailed information regarding the lack of permissions that is preventing page properties from being updated. Could you please review the error below and advise if I need to enable any additional loggers to get more details about the path where permissions are missing?

Additionally, this issue occurs only on the root page; all other child pages, which use the same template and permissions, remain editable.

Also, this is happening in Production and I am unable to replicate it in lower environments. I am considering further debugging by moving the users/groups to my local instance to see if I can write a script to check for any conflicting ACL permissions. Please let me know if I need to create any packages with specific paths to troubleshoot this further.

org.apache.jackrabbit.oak.security.authorization.permission

org.apache.jackrabbit.oak.api.CommitFailedException

org.apache.sling.jcr.resource.internal.helper.jcr.JcrResourceProvider

org.apache.sling.servlets.post.impl.operations.ModifyOperation

Error log:

23.10.2025 16:50:00.729 *ERROR* [198.203.177.167 [1761238200618] POST /content/testproduct/en/_jcr_content HTTP/1.1] org.apache.sling.servlets.post.impl.operations.ModifyOperation Exception during response processing.

org.apache.sling.api.resource.PersistenceException: Unable to commit changes to session.

at org.apache.sling.jcr.resource.internal.helper.jcr.JcrResourceProvider.commit(JcrResourceProvider.java:519) [org.apache.sling.jcr.resource:3.0.18]

at org.apache.sling.resourceresolver.impl.providers.stateful.AuthenticatedResourceProvider.commit(AuthenticatedResourceProvider.java:240) [org.apache.sling.resourceresolver:1.10.0]

at org.apache.sling.resourceresolver.impl.helper.ResourceResolverControl.commit(ResourceResolverControl.java:531) [org.apache.sling.resourceresolver:1.10.0]

at org.apache.sling.resourceresolver.impl.ResourceResolverImpl.commit(ResourceResolverImpl.java:1031) [org.apache.sling.resourceresolver:1.10.0]

at org.apache.sling.servlets.post.impl.operations.AbstractPostOperation.run(AbstractPostOperation.java:164) [org.apache.sling.servlets.post:2.3.26]

at org.apache.sling.servlets.post.impl.SlingPostServlet.doPost(SlingPostServlet.java:228) [org.apache.sling.servlets.post:2.3.26]

at org.apache.sling.api.servlets.SlingAllMethodsServlet.mayService(SlingAllMethodsServlet.java:146) [org.apache.sling.api:2.27.2]

at org.apache.sling.api.servlets.SlingSafeMethodsServlet.service(SlingSafeMethodsServlet.java:342) [org.apache.sling.api:2.27.2]

at org.apache.sling.api.servlets.SlingSafeMethodsServlet.service(SlingSafeMethodsServlet.java:374) [org.apache.sling.api:2.27.2]

at org.apache.sling.engine.impl.request.RequestData.service(RequestData.java:545) [org.apache.sling.engine:2.15.10]

at org.apache.sling.engine.impl.filter.SlingComponentFilterChain.render(SlingComponentFilterChain.java:45) [org.apache.sling.engine:2.15.10]

at org.apache.sling.engine.impl.filter.AbstractSlingFilterChain.doFilter(AbstractSlingFilterChain.java:88) [org.apache.sling.engine:2.15.10]

at com.day.cq.wcm.core.impl.WCMDebugFilter.doFilter(WCMDebugFilter.java:138) [com.day.cq.wcm.cq-wcm-core:5.12.268.CQ650-B0008]