2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-7887

CVE-2026-7887: For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status

For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned, terminated employee) can still authenticate via OAuth and receive valid API tokens. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. Thanks 0x4c616e for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-7887

CVE-2026-7887:

2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	< 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-7887, allowed inactive users in Concrete CMS to obtain valid OAuth 2.0 API tokens because the system did not properly check the account status during authentication. This issue affected both the Authorization Code and Password grant types.

Authorization Code Grant: When a user authenticates to authorize a client application, the Concrete\Controller\SinglePage\Login::do_login method is called. The original implementation failed to check if the user's account was active (uIsActive=0) after verifying their password. The patch rectifies this by adding a check with the $user->isActive() method. If the user is inactive, they are immediately logged out, preventing them from authorizing the client and stopping the issuance of an authorization code.
Password Grant: For clients using the direct password grant, the Concrete\Core\Api\OAuth\Authorizer::validateUser method is responsible for validating credentials. The original code only checked the username and password. The patch introduces a check to ensure the user is registered and active before an access token is issued.

By patching both do_login and validateUser, the vulnerability is addressed comprehensively, ensuring that inactive users can no longer authenticate or obtain API tokens through either of the primary OAuth 2.0 flows.

Vulnerable functions

Concrete\Controller\SinglePage\Login::do_login

concrete/controllers/single_page/login.php

The `do_login` function handles user authentication. Before the patch, it did not check if a user account was active after successful credential validation. This allowed an inactive user (e.g., suspended or banned) to log in. In an OAuth 2.0 Authorization Code Grant flow, this would permit the inactive user to authorize a client application, which could then obtain a valid access token.

Concrete\Core\Api\OAuth\Authorizer::validateUser

concrete/src/Api/OAuth/Authorizer.php

The `validateUser` function is used in the OAuth 2.0 Password Grant flow to validate a user's credentials. Prior to the patch, this function only verified the username and password, without checking if the user's account was active. This allowed an inactive user to directly obtain a valid access token by providing their credentials to a client application using the password grant type.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.