Executive brief
Concrete CMS is a content management system used to build and manage websites. A flaw in its OAuth authentication system allowed deactivated, deleted, or locked user accounts to retain full API access via previously issued tokens. This means a user whose account was disabled for security reasons could continue to access and potentially modify website data through the REST API indefinitely.
Technical details
Concrete CMS before 9.5.4 failed to re-validate account status during OAuth REST API authorization requests. The authorization validator checked only that a bearer token existed, had not expired, and had not been explicitly revoked, but did not verify that the account which issued the token remained active. Deactivating, deleting, or locking a user account did not revoke outstanding OAuth tokens. An attacker with a previously issued token from a deactivated account could access endpoints under /ccm/api/1.0/* with the original account's privileges. The vulnerability requires prior possession of a valid OAuth token and applies only to REST API endpoints. Patches are available in version 9.5.4 and later.
Affected products
- Concrete CMS Concrete CMS before 9.5.4
Timeline
- 2026-09-16: disclosed