CVE-2026-18115: Concrete CMS Authentication Bypass Vulnerability

CVE-2026-18115 Overview

CVE-2026-18115 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions 9.2.0 through 9.5.2. The REST API user write endpoints do not enforce per-field edit_user_properties permissions. An attacker holding an update-scoped OAuth token with permission to edit only a single non-sensitive field can modify another non-superuser's password, username, email, and attributes. This allows full account takeover of any non-superuser account through the PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password endpoints.

Critical Impact

An authenticated user with narrowly scoped edit permissions can take over other non-superuser accounts via the REST API, bypassing per-field authorization checks.

Affected Products

• Concrete CMS 9.2.0 through 9.5.2
• REST API endpoint PUT /ccm/api/1.0/users/{uID}
• REST API endpoint POST /ccm/api/1.0/users/{uID}/change_password

Discovery Timeline

• Vulnerability reported by riodrwn to the Concrete CMS security team
• 2026-09-15 - CVE-2026-18115 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-18115

Vulnerability Analysis

The vulnerability resides in Concrete CMS's REST API user write handlers. The endpoints accept a JSON payload containing multiple user fields and process the entire payload with a single coarse-grained authorization check. The per-field edit_user_properties permission model is not applied on write operations. An attacker granted permission to change one benign attribute can therefore submit a request that also modifies sensitive fields such as password, email, and username on a target account.

This is a broken access control flaw. It converts a low-value delegation, such as the ability to update a display name, into a full account takeover primitive against any non-superuser. Superuser accounts remain out of scope because a separate check blocks writes against them.

Root Cause

The root cause is missing authorization [CWE-862] at the field granularity. The API layer authorizes the request against a single scope but does not iterate the submitted fields and evaluate edit_user_properties per attribute. Sensitive attributes are not gated by additional checks that would require elevated permissions before accepting password, username, or email changes.

Attack Vector

Exploitation requires network access to the API and a valid OAuth token with update scope on the users resource. The attacker sends a PUT request to /ccm/api/1.0/users/{uID} targeting a victim account, populating the payload with attacker-controlled values for password, email, username, and attributes. The server applies all fields without validating that the caller holds edit_user_properties on each. A follow-up POST to /ccm/api/1.0/users/{uID}/change_password can be used to reset the victim credential directly. Refer to the ConcreteCMS 9.5.3 Release Notes for the vendor's technical description.

Detection Methods for CVE-2026-18115

Indicators of Compromise

• Unexpected PUT /ccm/api/1.0/users/{uID} requests where the requesting OAuth client is not the target user
• Calls to POST /ccm/api/1.0/users/{uID}/change_password originating from tokens not associated with the target uID
• Sudden email or username changes on user accounts followed by password reset activity
• OAuth tokens with narrow edit_user_properties scope generating high-volume writes across many user IDs

Detection Strategies

• Parse Concrete CMS API access logs to correlate the acting OAuth client with the target uID on user write endpoints
• Alert when a single OAuth token modifies multiple distinct user accounts within a short time window
• Compare the fields present in PUT /users/{uID} payloads against the caller's granted per-field permissions where recorded

Monitoring Recommendations

• Forward Concrete CMS web server and application logs to a centralized analytics platform for retention and correlation
• Monitor authentication events for anomalous logins immediately following user profile modifications
• Track OAuth token issuance and scope grants to identify over-privileged integrations
• Baseline normal write patterns on /ccm/api/1.0/users/ and alert on deviations

How to Mitigate CVE-2026-18115

Immediate Actions Required

• Upgrade Concrete CMS to version 9.5.3 or later, where per-field authorization is enforced on the affected endpoints
• Audit all OAuth tokens currently issued with any user-scope write permission and revoke tokens that are not strictly required
• Review user account audit logs since deployment of 9.2.0 for unauthorized password, email, or username changes
• Force password resets on non-superuser accounts if unauthorized modifications are suspected

Patch Information

Concrete CMS addressed CVE-2026-18115 in version 9.5.3. The fix enforces edit_user_properties permissions per field on the REST API user write endpoints. See the ConcreteCMS 9.5.3 Release Notes for the full advisory and change list.

Workarounds

• Restrict network access to /ccm/api/1.0/users/ endpoints at a reverse proxy or web application firewall until the patch is applied
• Do not issue OAuth tokens with update scope on the users resource to untrusted integrations or low-privilege operators
• Disable the REST API entirely if it is not required for business operations

# Example: block user write endpoints at an nginx reverse proxy until patched
location ~ ^/ccm/api/1\.0/users/[0-9]+(/change_password)?$ {
    if ($request_method ~ ^(PUT|POST)$) {
        return 403;
    }
    proxy_pass http://concretecms_backend;
}