CVE-2026-7887
For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned,
CVSS
6.4
Medium
EPSS
0.2%
p7
KEV
—
Exploit Today
2
0-100
Published: May 21, 2026 · Last modified: Jul 23, 2026 · CWE-1287
0.2%EPSS · 30 days0.2%
2026-07-062026-08-02
For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned, terminated employee) can still authenticate via OAuth and receive valid API tokens. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. Thanks 0x4c616e for reporting.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-93909.1 CRI—
———XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup.
verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators.
A crafted URI can make the lookup match elements the reference does not name, or every element in the document, so which node is selected for digest verification is decided by the injected expression rather than by the reference.11hCVE-2026-204986.0 MED—
——0In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10900493; Issue ID: MSV-6765.11hCVE-2026-47738.1 HIG24.4%
——7Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass.
This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10.13dCVE-2026-505247.5 HIG46.9%
——14Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.12dCVE-2026-450699.1 CRI14.8%
——4Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.20dCVE-2026-551245.5 MED34.7%
——10Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.19d