CVE-2026-18115 In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover.

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edituserproperties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/changepassword. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could...