Is CVE-2026-81921 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81921 being exploited in the wild.

How severe is CVE-2026-81921?

Medium severity, with a CVSS score of 5.4, published 15 September 2026.

Which products and versions are affected?

Concrete CMS 8.5.3 through 9.5.2.

Is there a fix for CVE-2026-81921?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-81921 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-81921?

Check whether you run Concrete CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81921: Concrete CMS OAuth 2.0 refresh token account status bypass

CVE-2026-81921 · Severity: medium · CVSS 5.4 · Published 2026-09-15

Concrete CMS is a content management system that provides API access via OAuth 2.0 tokens. A flaw in token refresh handling allowed deactivated or suspended user accounts to continue generating valid API access tokens indefinitely, meaning account deactivation did not revoke API access. An attacker with a previously-obtained refresh token could maintain unauthorized API access even after their account was disabled.

Technologies: Concrete CMS. Vendors: Concrete CMS.

Quick answers

Is CVE-2026-81921 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81921 being exploited in the wild.
How severe is CVE-2026-81921?: Medium severity, with a CVSS score of 5.4, published 15 September 2026.
Which products and versions are affected?: Concrete CMS 8.5.3 through 9.5.2.
Is there a fix for CVE-2026-81921?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-81921 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-81921?: Check whether you run Concrete CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Concrete CMS's implementation of OAuth 2.0 refresh-token grant flow using the unmodified upstream League grant library. When issuing new access tokens from a valid refresh token, the system failed to re-check whether the associated user account's active status (uIsActive flag) had changed. This means a refresh token obtained by an active user could continue to mint valid access tokens even after that account was deactivated or suspended. The flaw requires an attacker to have previously obtained a valid refresh token while the account was active, and involves network-based API requests. The attack has no user interaction requirement beyond the initial token compromise. No patch availability information is provided in the advisory.

Affected products

Concrete CMS Concrete CMS 8.5.3 through 9.5.2

Timeline

2026-09-15: disclosed: CVE-2026-81921 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.