Vulnerability · Published Sep 16, 2026 · Assigned by ConcreteCMS
CVE-2026-85387Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access
Low 2.0
In plain English
A low-severity security flaw in Concrete CMS from Concrete CMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Official description
Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revoked, and deactivating a user did not revoke that user's outstanding tokens. As a result, a deactivated user retained full access to /ccm/api/1.0/* for the remaining lifetime of any token already issued to them. The same gap applied to accounts that had been deleted or locked pending a forced password reset. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Myq Larson for reporting.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Concrete CMS | Concrete CMS | 5.0.0 – through 9.5.3 |
Weakness: CWE-613 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N