CVE-2026-7887
OAuth 2.0 Authorization Bypass in Concrete CMS
Publication date: 2026-05-21
Last updated on: 2026-05-21
Assigner: ConcreteCMS
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| concrete_cms | concrete_cms | to 9.5.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1287 | The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Concrete CMS version 9.5.0 and below. It involves the OAuth 2.0 Authorization-Code Handler, which bypasses account status checks. Specifically, a user whose account is marked as inactive (such as suspended, banned, or a terminated employee) can still authenticate using OAuth and obtain valid API tokens.
How can this vulnerability impact me? :
The impact of this vulnerability is that users who should no longer have access to the system (inactive or banned users) can still authenticate and gain valid API tokens. This could allow unauthorized access to protected resources or services, potentially leading to data exposure or misuse.