CVE-2026-85387 Concrete CMS CVE debrief

Who should care

Defenders and administrators of Concrete CMS installations should assess exposure and prioritize remediation. They should verify user account status and token revocation for API endpoints, review and adjust API access controls, and update Concrete CMS to version 9.5.4 or later. Security teams and vulnerability management teams should also be aware of the potential impact and take necessary actions.

Why it matters

A vulnerability in Concrete CMS before version 9.5.4 allows deactivated or deleted users to retain access to certain API endpoints due to inadequate re-authorization checks.

• Verify user account status and token revocation for API endpoints
• Update Concrete CMS to version 9.5.4 or later
• Review and adjust API access controls

Technical summary

Concrete CMS before 9.5.4 did not properly re-authorize OAuth REST API requests, allowing deactivated or deleted users to retain access to certain endpoints. The vulnerability arises from the CMS's authorization validator confirming only that a token existed, had not expired, and had not been explicitly revoked, without re-checking the state of the account the token had been issued to. This oversight enables users with deactivated or deleted accounts to retain access to specific API endpoints until the token expires.

Defensive priority

Defenders should prioritize verifying user account status and token revocation for API endpoints.

Recommended defensive actions

• Verify user account status and token revocation for API endpoints
• Update Concrete CMS to version 9.5.4 or later
• Review and adjust API access controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was reported by Myq Larson and assigned a CVSS v4.0 score of 2.0 by the Concrete CMS security team. The score reflects the severity of the vulnerability, which allows deactivated or deleted users to retain access to certain API endpoints. The issue is due to inadequate re-authorization checks in Concrete CMS before version 9.5.4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.