GHSA-f54h-78c9-c24hLow

Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status

Published
May 22, 2026
Last Modified
June 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-7887 →

📋 Description

For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned, terminated employee) can still authenticate via OAuth and receive valid API tokens. 

🎯 Affected products1

  • composer/concrete5/concrete5:< 9.5.1

🔗 References (3)