CVE-2026-18115CWE-862broken-access-control

CVE-2026-18115

published September 15, 2026

CVSS
7.4
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password). A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could change another non-superuser's password, username, email, and attributes, taking over that account. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.4 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.

The record
Technical detail
CVSS
7.4 · NONE
CVSS v4.0
7.4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00260 · 16.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-15T22:17Z
References (1)
https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes · ff5b8ace-8b95-4078-9743-eac1ca5451de
EPSS history
Timeline
  • 17 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 15 SEP 17:39Z
    In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover.
    cvelistv5