CVE-2026-81921

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 8.5.3 through 9.5.2

Description The OAuth 2.0 refresh-token grant uses an unmodified upstream League grant that issues new access tokens from a valid refresh token without verifying the current active status of the associated account. This allows a user who previously obtained a refresh token to continue generating valid access tokens even after their account has been deactivated or suspended (where uIsActive is set to 0), meaning account deactivation fails to revoke API access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.