OAuth REST API Authorization Flaw in Concrete CMS by Concrete5

CVE-2026-85387

What is CVE-2026-85387?

In Concrete CMS versions before 9.5.4, an authorization flaw allows re-authorization of OAuth REST API requests solely based on the bearer token. This means that once a token is issued, the system does not re-verify the current state of the associated account. Users who have been deactivated or deleted still retain access via outstanding tokens, resulting in potential unauthorized API access. This oversight could allow an attacker to exploit deprecated tokens for insecure access to sensitive resources.

References