CVE-2026-81921: In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status

Q: Who is exposed to this issue?

Concrete CMS deployments running versions 8.5.3 through 9.5.2 are affected if an account obtained a valid OAuth 2.0 refresh token while it was active. The issue concerns API access obtained through the refresh-token grant.

Q: What does an attacker need to exploit it?

The attacker needs a valid refresh token associated with an account that was active when the token was issued. They can use that token to obtain new access tokens after the account is deactivated or suspended.

Q: Does deactivating or suspending the account remove the affected access?

No. In the affected versions, the refresh-token grant does not re-check whether the associated account is active, so deactivation does not prevent the token from minting new API access tokens.

Published Sep 15, 2026

Updated

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could therefore continue to mint valid access tokens after being deactivated or suspended (uIsActive=0), so deactivating an account did not revoke its API access. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L. Thanks sh4d0byss for reporting.

Affected Software

1 affected component

Concrete CMS Concrete CMS>=8.5.3<=9.5.2

Event History

Sep 15, 2026

CVE Published

via MITRE·06:48 PM

Data Sourced

via MITRE·06:48 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Concrete CMS deployments running versions 8.5.3 through 9.5.2 are affected if an account obtained a valid OAuth 2.0 refresh token while it was active. The issue concerns API access obtained through the refresh-token grant.

What does an attacker need to exploit it?

The attacker needs a valid refresh token associated with an account that was active when the token was issued. They can use that token to obtain new access tokens after the account is deactivated or suspended.

Does deactivating or suspending the account remove the affected access?

No. In the affected versions, the refresh-token grant does not re-check whether the associated account is active, so deactivation does not prevent the token from minting new API access tokens.