Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access

Description

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revoked, and deactivating a user did not revoke that user's outstanding tokens. As a result, a deactivated user retained full access to /ccm/api/1.0/* for the remaining lifetime of any token already issued to them. The same gap applied to accounts that had been deleted or locked pending a forced password reset. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Myq Larson for reporting.

Scores

EPSS (exploitation in 30 days)

0.26% · top 82% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.0.

Weakness

• CWE-613 Insufficient Session Expiration (opens in a new tab)All about CWE-613 and its CVEs

Affected products

• Concrete CMS · Concrete CMS

  • affected 5.0.0 – ≤ 9.5.3

References (1)

• https://documentation.concretecms.org/developers/introduction/version-history/954-release-notes (opens in a new tab)release-notes

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-85387](https://trackcve.app/badge/CVE-2026-85387.svg)](https://trackcve.app/cve/CVE-2026-85387)

Record last updated 17 Sept 2026, 17:32 UTC.