Concrete CMS REST API Account Takeover via Permission Bypass

Executive Summary

Concrete CMS versions 9.2.0 to 9.5.2 had a flaw in REST API user write endpoints. The system did not properly enforce per-field edit_user_properties permissions. This allowed a user with an update-scoped OAuth token and limited permissions to change another non-superuser's password, username, email, or attributes, potentially taking over that account.

Useful 0 Not Useful 0

Detection Guidance

Check Concrete CMS versions between 9.2.0 and 9.5.2. Review REST API logs for PUT /ccm/api/1.0/users/{uID} or POST /ccm/api/1.0/users/{uID}/change_password requests with OAuth tokens. Monitor for unauthorized user modifications like password changes or email updates.

Useful 0 Not Useful 0

Impact Analysis

If you are a Concrete CMS user with version 9.2.0 to 9.5.2, an attacker with limited access could take over your account by changing your password or other credentials. This could lead to unauthorized access to your data, loss of control over your account, or further compromise of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected Concrete CMS versions may face compliance violations, legal penalties, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Concrete CMS to a version beyond 9.5.2. Review and restrict OAuth token permissions to enforce per-field edit_user_properties. Disable non-essential user modification endpoints if not required. Audit user accounts for unauthorized changes.

Useful 0 Not Useful 0