OAuth 2.0 Token Mismanagement in Concrete CMS by Concrete5

CVE-2026-81921

What is CVE-2026-81921?

Concrete CMS versions 8.5.3 through 9.5.2 include a significant vulnerability related to the OAuth 2.0 refresh-token grant. This flaw allows users who have obtained a valid refresh token to continue generating new access tokens even after their account has been deactivated or suspended. This occurs because the system fails to re-validate the account's active status upon issuing new tokens. As a result, deactivation of user accounts does not effectively revoke their API access, raising serious concerns regarding unauthorized access and API security. This vulnerability compromises the integrity of account management, potentially allowing continued access to sensitive data even after user accounts have been disabled.

References