CyberRota Analysis
AI-GeneratedConcrete CMS versions 8.5.3 to 9.5.2 are vulnerable due to improper handling of OAuth 2.0 refresh tokens, allowing users to generate new access tokens even after their accounts have been deactivated or suspended. This oversight could lead to unauthorized API access, posing a risk to account security and data integrity. Organizations using these versions should prioritize patching to mitigate potential exploitation of this vulnerability.
Original NVD Description
Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could therefore continue to mint valid access tokens after being deactivated or suspended (uIsActive=0), so deactivating an account did not revoke its API access. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L. Thanks sh4d0byss for reporting.