Executive brief
Concrete CMS is a popular website content management system that powers thousands of websites. Attackers with limited edit permissions via the REST API could bypass security checks and take over other user accounts by changing their passwords, usernames, and email addresses. This vulnerability allows privilege escalation and account takeover with only moderate prerequisites.
Technical details
The vulnerability is an authorization bypass in the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password) in Concrete CMS versions 9.2.0 through 9.5.2. The per-field edit_user_properties permissions were not enforced on these endpoints, allowing a user with an update-scoped OAuth token and permission to modify only one non-sensitive field to instead modify sensitive fields including password, username, email, and user attributes of other non-superuser accounts. An attacker requires valid OAuth credentials with update scope and some edit permission to exploit this, but the impact is account takeover of other users. The issue has been patched in later versions.
Affected products
- Concrete CMS Concrete CMS 9.2.0 to 9.5.2
Timeline
- 2026-09-15: disclosed