Executive brief
Concrete CMS, a platform used for building and managing websites, contains a flaw in its login system. This vulnerability allows users who have been banned, suspended, or terminated to continue accessing the site's API using their existing credentials. This could lead to unauthorized data access or actions by individuals who should no longer have permission to use the system.
Technical details
A vulnerability exists in the OAuth 2.0 Authorization-Code handler of Concrete CMS versions 9.5.0 and below. The system fails to validate the 'uIsActive' status of a user during the OAuth authentication flow. Consequently, a user whose account is marked as inactive (uIsActive=0)—such as a banned user or a terminated employee—can still successfully authenticate and obtain valid API tokens. This is classified as an improper validation of input (CWE-1287). The issue is resolved in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed
- 2026-05-22: advisory: GitHub Advisory published
- 2026-05-21: patched: Version 9.5.1 released