CVE-2026-18115: In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover.
Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edituserproperties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/changepassword). A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could change another non-superuser's password, username, email, and attributes, taking over that account. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.4 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.2 - Configuration
Ensure Concrete CMS enforces per-field edit_user_properties permissions on the REST API user write endpoints: PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password (Missing Authorization in REST API Users update() and change_password).
Concrete CMS REST API (users update() and change_password) Enforce per-field edit_user_properties permissions on user write endpoints = Enabled
Event History
Frequently Asked Questions
Which accounts can be targeted?
An attacker can modify another non-superuser account. The exposed fields include the target account's password, username, email address, and attributes.
What access does an attacker need to exploit this?
The attacker needs an OAuth token scoped for user updates and permission to edit at least one non-sensitive user field. They do not need permission for the specific sensitive field they modify.
Are superuser accounts affected?
The described authorization bypass applies to other non-superuser accounts. The provided information does not indicate that superuser accounts can be modified through this issue.