Executive brief
Concrete CMS, a web content management system, contains a vulnerability in its REST API user creation endpoint that fails to properly verify user permissions. This allows an attacker with a valid OAuth token to create new user accounts without administrative approval or email verification, potentially enabling them to modify website content and inject malicious code.
Technical details
The vulnerability exists in the POST /ccm/api/1.0/users endpoint (add() method in concrete/src/Api/Controller/Users.php) in Concrete CMS versions 9.2.0 through 9.5.3. The endpoint does not perform permission checks before creating user accounts, allowing any request carrying a valid OAuth token with the users:add scope—including client_credentials tokens with no user context—to create active, validated accounts. This bypasses email verification and administrator approval workflows. Under default registration settings, these accounts can edit page content, creating a stored cross-site scripting (XSS) attack vector and enabling further system compromise. Patches are available in versions after 9.5.3.
Affected products
- Concrete CMS Concrete CMS 9.2.0 through 9.5.3
Timeline
- 2026-09-16: disclosed