Is CVE-2026-85387 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85387 being exploited in the wild.

How severe is CVE-2026-85387?

High severity, with a CVSS score of 7.1, published 16 September 2026.

Is there a fix for CVE-2026-85387?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85387 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85387?

Check whether you run Concrete CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85387: Concrete CMS OAuth REST API authorization bypass

CVE-2026-85387 · Severity: high · CVSS 7.1 · Published 2026-09-16

Concrete CMS is a content management system used to build and manage websites. A flaw in its OAuth authentication system allowed deactivated, deleted, or locked user accounts to retain full API access via previously issued tokens. This means a user whose account was disabled for security reasons could continue to access and potentially modify website data through the REST API indefinitely.

Technologies: Concrete CMS. Vendors: Concrete CMS.

Quick answers

Is CVE-2026-85387 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85387 being exploited in the wild.
How severe is CVE-2026-85387?: High severity, with a CVSS score of 7.1, published 16 September 2026.
Which products and versions are affected?: Concrete CMS before 9.5.4.
Is there a fix for CVE-2026-85387?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85387 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85387?: Check whether you run Concrete CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Concrete CMS before 9.5.4 failed to re-validate account status during OAuth REST API authorization requests. The authorization validator checked only that a bearer token existed, had not expired, and had not been explicitly revoked, but did not verify that the account which issued the token remained active. Deactivating, deleting, or locking a user account did not revoke outstanding OAuth tokens. An attacker with a previously issued token from a deactivated account could access endpoints under /ccm/api/1.0/* with the original account's privileges. The vulnerability requires prior possession of a valid OAuth token and applies only to REST API endpoints. Patches are available in version 9.5.4 and later.

Affected products

Concrete CMS Concrete CMS before 9.5.4

Timeline

2026-09-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.