Concrete CMS versions 8.5.3 through 9.5.2 implemented the OAuth 2.0 refresh‑token grant by re user’s active status when issuing new access tokens. By obtaining a fresh access token from a valid refresh token that was issued while the account was active, an attacker can continue to use the API even after the account has been deactivated or suspended. The flaw, classified as CWE‑862, results in an inadequate access control that permits unauthorized API access across the system, compromising data confidentiality and integrity for the affected account. The impact is limited to does not allow arbitrary code execution or system compromise beyond the API scope.

Concrete CMS (official product name: Concrete CMS), affected by the OAuth 2.0 refresh‑token grant mechanism in versions 8.5.3 through 9.5.2.

The CVSS v4.0 score of 2.3 denotes a low, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation. However, exploitation requires prior acquisition of a valid refresh token, typically through credential compromise or token leakage. Once possessed, the token can be reused indefinitely, allowing continuous API access until the token is explicitly revoked. The attack surface is therefore confined to accounts that have already been authenticated and granted a refresh token before deactivation. Even then, the lack of a publicly available exploit script or known incidents indicates that active exploitation is currently unlikely but the risk remains for environments that rely on OAuth authentication.