Page Properties Not Editable for Specific User Groups Despite Correct Permissions

[test1234567]

Hello Community,

We're encountering an issue affecting a specific user group. These users already have Read, Modify, Create, and Delete permissions for the page. They can edit and update components authored on the page and add new components as well. However, when trying to update the page properties, none of the fields or tabs in the page properties are editable. When attempting to save the page, the users receive the following error:

org.apache.sling.api.resource.PersistenceException: Unable to commit changes to session.

This issue does not occur for admin users. Granting additional ACL privileges resolves the issue, but we are not supposed to grant such permissions to this group. Additionally, users are able to update the page properties of child pages without any issues, and those child pages use the same template and permissions. The root page is not locked, and users with the same permission level have previously been able to update the page without any problems.

Can someone advise what could be causing this issue? Would copying the same page to a lower environment help in troubleshooting? Do we need to enable any additional debug logs to investigate further? I tried to enable logs for org.apache.sling.api.resource.PersistenceException, but 'resource.PersistenceException' is not available for log configuration. Should I try adding any additional packages to assist in debugging this issue?

Page JSON:

{
"jcr:primaryType": "cq:PageContent",
"jcr:mixinTypes": [
"mix:lockable",
"mix:versionable"
],
"jcr:createdBy": "admin",
"jcr:title": "Test Root Page",
"cq:lastReplicationAction": "Activate",
"jcr:versionHistory": "dc84b5ea-747f-4a35-840a-30bc6b0e3c3c",
"cq:template": "/conf/test/settings/wcm/templates/test-template",
"cq:lastReplicatedBy": "workflow-process-service",
"assetSubSection": "",
"jcr:language": "en_us",
"modifiedDate": "2025-10-09T05:33:45",
"jcr:predecessors": [
"f4015987-536a-4545-b2b0-2766e31070f2"
],
"jcr:created": "Tue Apr 23 2024 00:02:11 GMT+0000",
"cq:lastReplicated": "Wed Oct 15 2025 03:00:32 GMT+0000",
"cq:lastModified": "Thu Oct 16 2025 20:01:21 GMT+0000",
"cq:cloudserviceconfigs": [
"/etc/cloudservices/test/config"
],
"jcr:description": "Test Description",
"jcr:baseVersion": "f4015665-536a-4545-b2b0-2766e31070f2",
"pageTitleUms": "Test",
"jcr:isCheckedOut": true,
"disablebydefault": "false",
"pageTitle": "Test Product",
"cq:skippedPages": [],
"jcr:uuid": "2200817c-fb84-45e6-8b99-dcd96b473ecc",
"sling:resourceType": "test/components/page/layout",
"textIsRich": "true",
"cq:premodernizeVersion": "33410e1b-42a1-4e44-ae9b-534bf425cf45",
"cq:lastModifiedBy": "test@test.com,
"navTitle": "ROOT PAGE",
"root": {
"jcr:primaryType": "nt:unstructured",
"sling:resourceType": "wcm/foundation/components/responsivegrid",
"responsivegrid": {
"jcr:primaryType": "nt:unstructured",
"jcr:mixinTypes": [
"cq:ReplicationStatus"
],
"jcr:createdBy": "admin",
"jcr:lastModifiedBy": "admin",
"jcr:created": "Tue Aug 23 2022 09:24:43 GMT-0500",
"jcr:lastModified": "Fri Sep 05 2025 17:22:05 GMT+0000",
"sling:resourceType": "wcm/foundation/components/responsivegrid",
"layout_container_cop": {
"jcr:primaryType": "nt:unstructured",
"jcr:mixinTypes": [],
"jcr:createdBy": "lburg",
"internalMarginHorizontal": "none",
...........
}
}
}
}

@aanchal-sikka 

@davidjgonzalezzzz @EstebanBustamante @RiteshY18 @Gokul_Agiwal @Umesh_Thakur @pradnya_balvir @Amelia_Waliany @ParitMittal @pradnya_balvir
@Umesh_Thakur @AmitVishwakarma @HrishikeshKagne 

[VishalKa5]

Hi @test1234567 ,

This issue happens because the user group is missing some required permissions on hidden system nodes linked to the page, even though they already have read, modify, create, and delete rights. When they try to save page properties, AEM also updates things like locks, version history, or cloud service configs, and without access to those nodes, the save fails with “Unable to commit changes.” Admins don’t face this issue because they have full access, and child pages work because they don’t reference those extra configurations. The solution is to add minimal permissions like lock management and node type management on the page and read access to related paths like /conf and /etc/cloudservices. No need to give full admin rights. Debug logs can help identify the exact missing permission if needed.

Thanks & Regards,

Vishal

[test1234567]

Thanks for your reply. Regarding locks and version history permissions, do we need to grant permissions to any specific paths, and what kind of permissions are required? For example, is only Read permission sufficient, or are additional permissions needed? Also, based on the error, should we enable any logs for a specific package to help troubleshoot the issue further?

[VishalKa5]

Hi @test1234567 ,

Yes, you will need to give a few specific permissions in addition to the normal read and write access on the page. When a user saves page properties in AEM, the system may also need to create a version, update locks, or read template and cloud configurations linked to that page. So, you should give the group lock management permission on the page path so they can lock and unlock the page, and read access to version history and configuration paths like /var/versions (or /jcr:system/jcr:versionStorage in on-prem), /conf, and /etc/cloudservices. Read access is enough for those system paths, and only the page path needs modify and lock permissions. To troubleshoot this further, you can enable debug logs for Oak security and access control to see exactly which permission is missing during the failure. These logs will clearly show what is being blocked so you can fix it quickly without giving full admin rights.

Thanks & regards,

Vishal