CyberRota Analysis
AI-GeneratedConcrete CMS versions 9.2.0 to 9.5.2 are vulnerable due to insufficient permission enforcement on REST API user write endpoints, allowing users with limited update permissions to modify sensitive account information of other non-superuser accounts. This flaw can lead to account takeover, as an attacker could change passwords, usernames, and emails. Organizations using these versions should prioritize patching this vulnerability to mitigate the risk of unauthorized access and account compromise.
Original NVD Description
Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password). A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could change another non-superuser's password, username, email, and attributes, taking over that account. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.4 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.