Executive brief
Concrete CMS is a content management system that provides API access via OAuth 2.0 tokens. A flaw in token refresh handling allowed deactivated or suspended user accounts to continue generating valid API access tokens indefinitely, meaning account deactivation did not revoke API access. An attacker with a previously-obtained refresh token could maintain unauthorized API access even after their account was disabled.
Technical details
The vulnerability exists in Concrete CMS's implementation of OAuth 2.0 refresh-token grant flow using the unmodified upstream League grant library. When issuing new access tokens from a valid refresh token, the system failed to re-check whether the associated user account's active status (uIsActive flag) had changed. This means a refresh token obtained by an active user could continue to mint valid access tokens even after that account was deactivated or suspended. The flaw requires an attacker to have previously obtained a valid refresh token while the account was active, and involves network-based API requests. The attack has no user interaction requirement beyond the initial token compromise. No patch availability information is provided in the advisory.
Affected products
- Concrete CMS Concrete CMS 8.5.3 through 9.5.2
Timeline
- 2026-09-15: disclosed: CVE-2026-81921 published