CVE-2026-87031

Executive Summary

CVE-2026-87031 is a missing authorization vulnerability (CWE-862) in the Concrete CMS REST API user creation endpoint, affecting versions 9.2.0 through 9.5.3. The endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) failed to perform a permission check before creating an account, allowing any valid OAuth token carrying the "users:add" scope — including a client_credentials token with no associated user context — to create active, validated user accounts. Created accounts bypass email verification and administrator approval and, under default registration settings, can edit page content, providing a path to stored cross-site scripting and further compromise.

Technical Analysis

The vulnerability is a classic missing authorization check (CWE-862) at a state-changing REST API endpoint. According to the NVD description, in Concrete CMS 9.2.0 through 9.5.3 the REST API user creation endpoint (POST /ccm/api/1.0/users) implemented in the add() method of concrete/src/Api/Controller/Users.php did not perform a permission check before creating an account.

The attack surface is the public REST API exposed by Concrete CMS at /ccm/api/1.0/. Authentication to this API is performed via OAuth tokens. The specific deficiency is that the endpoint validated only the "users:add" scope on the presented token, but did not verify that the token holder had an authenticated user context or the appropriate authorization level to perform account creation. This means a client_credentials OAuth grant — which is typically issued for machine-to-machine access without any associated user identity — was sufficient to invoke the account creation logic.

The critical consequence is that the created account was immediately active and validated, bypassing both email verification and administrator approval workflows. Because the account was created in a validated state, it inherited the privileges granted to newly registered users under the site's default registration settings. Per the description, under default registration settings these accounts could edit page content.

Because page content editing is available to the created account, an attacker can inject persistent (stored) content that is later rendered to other users, establishing a stored cross-site scripting (XSS) path. The XSS then serves as a pivot for session theft, privilege escalation against administrative users, or further compromise of the CMS instance.

The Concrete CMS security team assigned this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Note the low base score reflects the high privileges (PR:H) required to possess a token bearing the "users:add" scope, the attack prerequisites (AT:P) implied by the need for a valid OAuth token, and the limited direct confidentiality impact (VC:N). Integrity impact to the vulnerable system is low (VI:L). No values were provided for an affected versions array, OSV packages, EPSS, or a vendor fix; the patch confidence is 0/4 and the advisory explicitly frames the affected range as 9.2.0 through 9.5.3.

Insufficient technical detail is available in the provided data to describe the exact internal token validation routine, the specific authorization middleware, or the precise content-editing permission model beyond what is stated. No public PoC, Nuclei template, or exploit code was identified in the supplied data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (missing authorization / CWE-862) and the mechanics stated in the NVD description. Only endpoint, method, and scope names appearing verbatim in the description are used.

1. Reconnaissance / target identification. The attacker identifies an internet-exposed Concrete CMS instance running a version in the 9.2.0 - 9.5.3 range. The REST API base path /ccm/api/1.0/ and, specifically, the user creation endpoint POST /ccm/api/1.0/users are the target. The attacker enumerates whether the API is reachable and whether OAuth token issuance is available.

2. Obtaining or leveraging a token. The flaw is triggered by presenting any valid OAuth token carrying the "users:add" scope. Critically, per the description, this includes a client_credentials token with no associated user context. The attacker therefore does not need to compromise a human user's credentials or establish a user session; a machine-to-machine token bearing the required scope is sufficient.

3. Triggering the missing authorization. The attacker issues a POST request to /ccm/api/1.0/users (the add() method of concrete/src/Api/Controller/Users.php) using the token. Because no permission check is performed before account creation, the request succeeds and a new account is created. The account is created in an active, validated state — bypassing email verification and administrator approval.

4. Post-exploitation impact. Under default registration settings, the newly created account can edit page content. The attacker uses this content-editing capability to plant persistent content that is rendered to other users, establishing a stored XSS path. From there, the attacker can target higher-privileged users, attempt to steal sessions or elevate privileges, and further compromise the CMS instance. The limited integrity impact (VI:L) in the CVSS assessment reflects the direct effect of unauthorized account creation and content modification, while the stored XSS path expands the potential blast radius beyond the initial low-severity rating.

Impact Assessment

Business impact centers on unauthorized account creation, integrity loss, and a credible escalation path to stored cross-site scripting. Organizations running Concrete CMS versions 9.2.0 through 9.5.3 with the REST API exposed and OAuth tokens bearing the "users:add" scope are affected.

CVSS v4.0 vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N (base score 2.1).

• AV:N — network exploitable.
• AC:L — low attack complexity.
• AT:P — attack prerequisites are present (a valid OAuth token with the "users:add" scope is required).
• PR:H — the attacker must possess high-level privileges (the scoped token).
• UI:N — no user interaction required.
• VC:N / VI:L / VA:N — no confidentiality or availability impact to the vulnerable system; low integrity impact.
• SC:N / SI:N / SA:N — no subsequent system impact scored.

Blast radius: while the base score is low due to the high privilege requirement (PR:H) of holding a scoped token, the practical blast radius is elevated because client_credentials tokens are often issued to integrations and services and may be over-scoped or poorly managed. Any such token leaking or being broadly available creates a durable path to account creation and content manipulation. Because created accounts bypass verification and approval, they persist as legitimate-looking users, enabling downstream stored XSS against administrators and other users. EPSS has not yet been scored by FIRST.org and no CISA KEV listing exists.

Detection Guidance

Detection should focus on OAuth-authenticated POST requests to the user creation endpoint and the resulting creation of accounts by tokens lacking a user context.

Sigma Rule

title: Concrete CMS REST API Unauthorized User Creation (CVE-2026-87031)
id: 8f2c1b64-3d9a-4f7e-9c2a-1a7b6e5d0c31
status: experimental
description: Detects POST requests to the Concrete CMS REST API user creation endpoint that create accounts, indicating abuse of the missing permission check (CWE-862).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87031
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|contains: '/ccm/api/1.0/users'
  selection_status:
    sc-status: 201
  condition: selection_endpoint and selection_status
falsepositives:
  - Legitimate administrative or automated provisioning of users via the REST API
level: medium
tags:
  - attack.t1190
  - cve.2026-87031

YARA Rule

rule CVE_2026_87031_ConcreteCMS_Unauthorized_User_Creation
{
    meta:
        description = "Detects request artifacts referencing the Concrete CMS REST API user creation endpoint abused for unauthorized account creation (CVE-2026-87031)."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87031"
        date = "2026-01-01"

    strings:
        $ep1 = "/ccm/api/1.0/users" ascii wide nocase
        $scope1 = "users:add" ascii wide nocase
        $p1 = "POST /ccm/api/1.0/users" ascii wide nocase
        $ccm = "/ccm/api/1.0/" ascii wide nocase

    condition:
        uint16(0) == 0x4854 or  // "HT" for HTTP traffic or HAR-style logs
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87031 Concrete CMS REST API unauthorized user creation attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ccm/api/1.0/users"; http.uri; nocase; http.header; content:"Authorization"; nocase; classtype:attempted-admin; reference:cve,2026-87031; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87031; sid:90087031; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "POST" and http.request.uri : "/ccm/api/1.0/users" and http.response.status_code == 201 ]

Splunk SPL Query

index=web sourcetype=access_combined
| rex field=uri_path "^(?<api_path>/ccm/api/1\.0/users)"
| where request_method="POST" AND status=201 AND isnotnull(api_path)
| stats count values(src_ip) as source_ips by host, api_path, status
| where count > 0

Wazuh OSSEC Rule

<group name="web,concrete_cms,cve-2026-87031,">
  <rule id="10087031" level="10">
    <if_sid>31100</if_sid>
    <field name="url">/ccm/api/1.0/users</field>
    <field name="method">POST</field>
    <description>CVE-2026-87031: Possible Concrete CMS REST API unauthorized user creation via POST /ccm/api/1.0/users</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87031,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version array is available in the provided data.

1. Immediate mitigations

• Block or restrict network access to the REST API path /ccm/api/1.0/ at the reverse proxy or WAF, particularly POST /ccm/api/1.0/users, unless explicitly required.
• Audit all issued OAuth tokens and revoke/rotate any token carrying the "users:add" scope, especially client_credentials tokens with no associated user context. Apply the principle of least privilege to token scopes.
• Disable or restrict the REST API if it is not operationally required.
• Review and tighten default registration settings so newly created accounts cannot edit page content; disable or require administrator approval for new account content capabilities.

2. Patch / upgrade steps

• Monitor the Concrete CMS security advisories and the NVD entry for CVE-2026-87031 for an official patched release. As of available data, versions 9.2.0 through 9.5.3 remain affected and no patch reference is available.
• When a fix is released, upgrade to the patched version and re-verify that the user creation endpoint enforces a permission check independent of the mere "users:add" scope.

3. Long-term hardening

• Enforce authorization checks on all state-changing API endpoints, validating both scope and the authenticated user context and role.
• Harden OAuth issuance: eliminate over-scoped client_credentials tokens, enforce audience/role binding, and implement short token lifetimes with rotation.
• Deploy input sanitization and output encoding for all CMS content to mitigate stored XSS paths; enable CSP.
• Enable comprehensive API logging, alerting on the detections above, and periodic audit of newly created accounts against approved provisioning sources.
• Maintain a software bill of materials and vulnerability management process to track Concrete CMS versions and advisories.

References

• NVD — CVE-2026-87031: https://nvd.nist.gov/vuln/detail/CVE-2026-87031
• Concrete CMS Security Advisories: https://www.concretecms.org/security
• OWASP — Missing Function Level Access Control / CWE-862: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (no entry for CVE-2026-87031 at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, Nuclei template, or exploit code was identified. No known threat actor campaigns or exploit-in-the-wild evidence are available in the provided data. The vulnerability was reported to Concrete CMS by Winston Crooker.