CVE-2026-85387

Published: Set 16, 2026 Last Modified: Set 21, 2026
ExploitDB:
Other exploit source:
Google Dorks:
LOW 2,0
Source: ff5b8ace-8b95-4078-9743-eac1ca5451de
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: active
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 7,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: low
Availability: none

Description

AI Translation Available

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revoked, and deactivating a user did not revoke that user's outstanding tokens. As a result, a deactivated user retained full access to /ccm/api/1.0/* for the remaining lifetime of any token already issued to them. The same gap applied to accounts that had been deleted or locked pending a forced password reset. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Myq Larson for reporting.

613

Insufficient Session Expiration

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
Technologies: Web Based, Web Server
View CWE Details
Application

Concrete Cms by Concretecms

Product Information
Vendor Concretecms
Product Concrete Cms
Version Range Affected
To 9.5.4 (exclusive)
cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://documentation.concretecms.org/developers/introducti…
https://documentation.concretecms.org/developers/introduction/version-history/9…