This weakness allows an account that has been disabled—indicated by the flag uIsActive=0—to authenticate via the OAuth 2.0 Authorization‑Code flow. The legitimate user obtains a valid API token and can subsequently access resources that would normally be restricted to active users. The vulnerability does not provide remote code execution or system compromise; rather, it undermines the integrity of the user‑account enforcement mechanism.

Concrete CMS versions 9.5.0 and all earlier releases are affected. The issue resides in the OAuth 2.0 Authorization‑CodeHandler of the Concrete CMS platform.

The CVSS v4.0 score of 2.3 indicates a low severity. No exploits are known and it is not listed in the CISA KEV catalog, which suggests a modest likelihood of real‑world exploitation. Attackers would need valid OAuth credentials; the vulnerability does not expose additional privileged information. Nevertheless, the ability to obtain active API tokens for suspended, banned, or terminated accounts compromises the intended access control model and could lead to misuse of privileged API functions.