Home

Description

For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned, terminated employee) can still authenticate via OAuth and receive valid API tokens. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. Thanks 0x4c616e for reporting.

PUBLISHED Reserved 2026-05-05 | Published 2026-05-21 | Updated 2026-05-22 | Assigner ConcreteCMS




LOW: 2.3CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-1287 Improper validation of specified type of input

Product status

Default status
unaffected

5.0 (git)
affected

Credits

0x4c616e finder

References

documentation.concretecms.org/...n-history/951-release-notes release-notes

cve.org (CVE-2026-7887)

nvd.nist.gov (CVE-2026-7887)

Download JSON