Vulnerability Description
Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revoked, and deactivating a user did not revoke that user's outstanding tokens. As a result, a deactivated user retained full access to /ccm/api/1.0/* for the remaining lifetime of any token already issued to them. The same gap applied to accounts that had been deleted or locked pending a forced password reset. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Myq Larson for reporting.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-85387?
CVE-2026-85387 is a documented vulnerability. Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorizat...
How severe is CVE-2026-85387?
CVSS scoring is not yet available for CVE-2026-85387. Check NVD for updates.
Is there a patch for CVE-2026-85387?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.