CVE-2026-7887 Concrete CMS CVE debrief

Who should care

Security and platform teams running Concrete CMS with OAuth-based authentication, especially where suspended or offboarded accounts should be blocked immediately. Identity, application, and API administrators should also care if API tokens are issued through the same login path.

Technical summary

The vulnerability is an authentication/authorization-control failure in the OAuth 2.0 authorization-code handler. According to the supplied CVE description, the handler does not properly honor the uIsActive=0 account state, so a disabled user can complete OAuth login and obtain valid API tokens. NVD associates the record with CWE-1287 and reports the vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N.

Defensive priority

Prioritize as a low-severity but real access-control defect: fix promptly if OAuth login is enabled and account deactivation is part of your security or HR offboarding process. The main risk is continued authenticated access for accounts that were expected to be revoked.

Recommended defensive actions

• Review whether your Concrete CMS deployment uses OAuth 2.0 authorization-code login for user authentication or API token issuance.
• Apply the vendor remediation referenced in the Concrete CMS 9.5.1 release notes page and move off affected versions at 9.5.0 and below.
• Audit for accounts with uIsActive=0 that may still have recently obtained OAuth sessions or API tokens.
• Invalidate or rotate tokens for suspended, banned, or terminated users if your environment cannot immediately patch.
• Verify that account-status checks are enforced in your identity lifecycle and offboarding workflows.
• Monitor authentication logs for OAuth successes involving accounts that should be disabled.

Evidence notes

This debrief is based only on the supplied official sources: the NVD CVE record, the CVE.org record, and the referenced Concrete CMS release-notes URL. The CVE description states the affected scope (Concrete CMS 9.5.0 and below), the bypass condition (uIsActive=0), and the outcome (valid API tokens). The supplied NVD metadata also lists CWE-1287 and the CVSS v4.0 vector. The vendor attribution is low confidence in the source corpus, so the product name is treated as Concrete CMS based on the CVE description and official Concrete CMS reference link.

Official resources