CVE-2026-85387: Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access
Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revoked, and deactivating a user did not revoke that user's outstanding tokens. As a result, a deactivated user retained full access to /ccm/api/1.0/ for the remaining lifetime of any token already issued to them. The same gap applied to accounts that had been deleted or locked pending a forced password reset. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Myq Larson for reporting.
Affected Software
Event History
Frequently Asked Questions
Which accounts can still use the API after their access status changes?
Accounts that have been deactivated, deleted, or locked pending a forced password reset can retain access if they already hold an unexpired OAuth bearer token that has not been explicitly revoked.
What does an attacker need to exploit this issue?
The attacker must have a previously issued OAuth bearer token for an affected account. The token must still exist, be unexpired, and not have been explicitly revoked; API requests are then re-authorized from the token without checking the account's current state.
Is ordinary web login access affected?
The described impact is limited to OAuth-authenticated requests to /ccm/api/1.0/*. The provided information does not establish an impact on ordinary web login sessions.
What can be done before upgrading?
Explicitly revoke outstanding OAuth tokens for accounts that are deactivated, deleted, or locked pending a forced password reset. Deactivation alone does not revoke existing tokens in affected versions.
How can administrators identify potentially affected access?
Review OAuth tokens issued to accounts that were later deactivated, deleted, or locked, and identify tokens that remain unexpired and unrevoked. Such tokens may still authorize access to /ccm/api/1.0/* on versions before 9.5.4.