CVE-2026-85387

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revoked, and deactivating a user did not revoke that user's outstanding tokens. As a result, a deactivated user retained full access to /ccm/api/1.0/* for the remaining lifetime of any token already issued to them. The same gap applied to accounts that had been deleted or locked pending a forced password reset. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Myq Larson for reporting.

• CWE-613

• https://documentation.concretecms.org/developers/introduction/version-history/954-release-notesBroken Link

Published

Sep 16, 2026

Last Modified

Sep 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85381A security vulnerability has been detected in light0011 cms …5.3
• CVE-2026-85382A vulnerability was detected in light0011 cms c774dce31c6df0…4.3
• CVE-2026-85383A flaw has been found in itsourcecode Sales and Inventory Sy…6.3
• CVE-2026-85384A stack-based buffer overflow vulnerability exists in the ht…8.5
• CVE-2026-85385Concrete CMS below 9.5.4 did not validate the user timezone …9.6
• CVE-2026-85386Concrete CMS before 9.5.4 did not sanitize XML and XSLT docu…6.1
• CVE-2026-85388Worklenz through 3.0.0 fails to properly validate the sort-f…8.1
• CVE-2026-85389Worklenz before 3.0.0 fails to verify task ownership by orga…6.5
• CVE-2026-8539Script injection in SanitizerAPI in Google Chrome on Android…5.4
• CVE-2026-85390Checkmate through 3.11.0 omits the isAllowed role guard midd…7.1
• CVE-2026-85391Peppermint through 0.5.5 contains a hardcoded JWT signing se…9.8
• CVE-2026-85392Peppermint through 0.5.5 contains an authorization bypass vu…4.3