CVE-2026-87031: Concrete CMS Auth Bypass Vulnerability

CVE-2026-87031 Overview

CVE-2026-87031 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions 9.2.0 through 9.5.3. The REST API user creation endpoint POST /ccm/api/1.0/users, implemented by the add() method in concrete/src/Api/Controller/Users.php, does not perform a permission check before creating an account. Any valid OAuth token carrying the users:add scope, including a client_credentials token with no associated user context, can create active and validated accounts. The created accounts bypass email verification and administrator approval. Under default registration settings, these accounts can edit page content and reach stored cross-site scripting.

Critical Impact

Attackers holding a users:add-scoped OAuth token can create pre-validated user accounts, bypass approval workflows, and pivot to stored XSS through page editing.

Affected Products

• Concrete CMS 9.2.0 through 9.5.3
• Concrete CMS REST API endpoint POST /ccm/api/1.0/users
• concrete/src/Api/Controller/Users.php (add() method)

Discovery Timeline

• Vulnerability reported by Winston Crooker to the Concrete CMS security team
• 2026-09-16 - CVE-2026-87031 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87031

Vulnerability Analysis

The flaw resides in the Concrete CMS REST API user creation controller. The add() method in concrete/src/Api/Controller/Users.php accepts requests authenticated with an OAuth token that includes the users:add scope but does not verify that the requesting principal has permission to create users. The endpoint treats scope possession as sufficient for account creation. Accounts produced through this path are marked as active and validated, so they skip both email verification and administrator approval that the normal registration workflow enforces.

Root Cause

The root cause is a missing authorization check between authentication and the account creation logic. The controller trusts the OAuth scope alone and never confirms the caller holds an administrative role or user context. A client_credentials grant, which by design has no associated user, still satisfies the scope check and reaches the create logic. This is a textbook [CWE-862] Missing Authorization defect at the API layer.

Attack Vector

An attacker who obtains a client_credentials OAuth token with the users:add scope sends a POST request to /ccm/api/1.0/users containing the desired username, email, and password. The server returns an active, pre-validated account. On default installations, the newly created user can log in and edit page content, allowing injection of stored JavaScript into rendered pages. Stored XSS in an authenticated administrator session can then be used to escalate access further.

No verified proof-of-concept code is published. See the ConcreteCMS Version 9.5 Release Notes for vendor technical details.

Detection Methods for CVE-2026-87031

Indicators of Compromise

• Unexpected POST /ccm/api/1.0/users requests in web server access logs, especially from OAuth clients that should not manage users.
• New user accounts appearing in Concrete CMS with is_active and is_validated set at creation time and no matching registration email event.
• Page edits or content changes performed by recently created accounts that never completed the standard registration workflow.

Detection Strategies

• Alert on any successful POST to /ccm/api/1.0/users originating from a client_credentials OAuth token.
• Correlate OAuth token issuance logs against user creation events and flag mismatches where no interactive administrator session preceded the account creation.
• Review OAuth client registrations for any client granted the users:add scope and validate business justification.

Monitoring Recommendations

• Ingest Concrete CMS application logs and web server logs into a central analytics platform to build baselines for API user creation activity.
• Monitor for stored XSS indicators such as <script> tags or event-handler attributes appearing in page content edited by non-administrator accounts.
• Track OAuth token grants over time and alert on new tokens carrying privileged scopes like users:add.

How to Mitigate CVE-2026-87031

Immediate Actions Required

• Upgrade Concrete CMS to version 9.5.4 or later, which addresses the missing authorization check in the REST API user creation endpoint.
• Audit OAuth client registrations and revoke tokens carrying the users:add scope that are not strictly required.
• Review all user accounts created since deployment of an affected version and disable any account that cannot be tied to a legitimate registration.

Patch Information

Concrete CMS addressed the issue in the 9.5.4 release. Refer to the ConcreteCMS Version 9.5 Release Notes for the fixed version details and upgrade instructions.

Workarounds

• Disable the REST API user creation endpoint at the web server or reverse proxy layer if upgrading is not immediately possible.
• Remove the users:add scope from all OAuth clients that do not require programmatic user provisioning.
• Restrict default new-user permissions so newly created accounts cannot edit page content until an administrator promotes them.

# Example nginx block to deny external access to the vulnerable endpoint
location = /ccm/api/1.0/users {
    limit_except GET { deny all; }
}