CVE-2026-18115

Concrete CMS versions 9.2.0 through 9.5.2 fail to enforce per-field edit_user_properties permissions on the REST API user write endpoints, specifically PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password. An attacker who holds an update-scoped OAuth token and permission to edit even a single non-sensitive field can send crafted API requests to change another non-superuser's password, username, email, and attributes. The practical result is complete takeover of the targeted account, though superuser accounts are not affected; the Concrete CMS security team scored this CVSS v4.0 7.4 (high). Affected installations are Concrete CMS 9.2.0-9.5.2 deployments where the REST API and OAuth-based integrations are in use. No public proof-of-concept is known, the issue is not on the CISA KEV list, and no in-the-wild exploitation has been reported.

What to do: Upgrade affected Concrete CMS installations to a release newer than 9.5.2 (the latest 9.x) as soon as possible. Review API and OAuth logs for unexpected PUT/POST calls to the /ccm/api/1.0/users/ endpoints, and rotate credentials for any non-superuser accounts showing unexplained password, username, email, or attribute changes. If REST API integrations are not required, disable them and revoke unneeded update-scoped OAuth tokens until patched.