CVE-2026-87031

n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint POST /ccm/api/1.0/users, the add method of concrete/src/Api/Controller/Users.php did not perform a permission check before creating an account. As a result, any valid OAuth token carrying the users:add scope, including a...

PT-2026-93854

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.2.0 through 9.5.3 Description The REST API user creation endpoint 'POST /ccm/api/1.0/users', specifically the add function in concrete/src/Api/Controller/Users.php, fails to perform a permission check before creating an...

CVE-2026-18115

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edituserproperties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/changepassword. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could...