CVE-2026-18115

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.2.0 through 9.5.2

Description Insufficient authorization on REST API user write endpoints allows a user with an update-scoped OAuth token to modify sensitive account details of other non-superuser accounts. By exploiting the lack of per-field edit user properties permission enforcement, an attacker with permission to edit only one non-sensitive field can change the password, username, email, and attributes of another user, leading to full account takeover. The affected endpoints are 'PUT /ccm/api/1.0/users/{uID}' and 'POST /ccm/api/1.0/users/{uID}/change password'.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.