CVE-2026-7887

Vulnerability

CVE-2026-7887 affects the OAuth 2.0 authorization-code handler in Concrete CMS 9.5.0 and earlier. The handler does not check whether the authenticating user's account is active (uIsActive=0). As a result, users whose accounts have been suspended, banned, or terminated can still complete the OAuth flow and receive valid API tokens.

Exploitation

An attacker who knows the credentials of a suspended user (or who can obtain them through other means) can authenticate via the OAuth 2.0 authorization-code grant type. No special network position is required beyond being able to reach the login endpoint. The CVSS vector indicates a low attacker complexity and no user interaction needed.

Impact

Upon successful authentication, the suspended user gains API tokens that inherit the permissions the account had prior to suspension. This could enable unauthorized access to Concrete CMS APIs with the privileges of that user (e.g., reading or modifying content). The CVSS v4.0 score is 2.3, reflecting low impact to confidentiality and integrity, with no impact on availability.

Mitigation

Concrete CMS released version 9.5.1, which fixes this issue by ensuring that the OAuth handler checks the account's active status before issuing tokens [1]. Users should upgrade to 9.5.1 or later. No workaround is documented.