CVE-2026-54415: Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover
Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Azuriom CMSto a version that resolves this vulnerability.Fixed in 1.2.11 - Configuration
Enforce authorization checks in routes/admin.php and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}) so that only users with the admin.access permission can create AzLink server tokens or change user passwords and email addresses via /admin/servers/create and the AzLink API.
Azuriom CMS (routes/admin.php and AzLink API endpoints) authorization (admin.access permission) = require admin.access permission / enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54415?
CVE-2026-54415 has a severity rating of high, with a score of 8.6.
How do I fix CVE-2026-54415?
To fix CVE-2026-54415, upgrade to Azuriom CMS version 1.2.11 or later.
What types of attacks can be executed due to CVE-2026-54415?
CVE-2026-54415 allows authenticated attackers to perform account takeover by changing non-admin user passwords and emails.
What permissions are required for exploiting CVE-2026-54415?
Exploitation of CVE-2026-54415 requires the attacker to have admin.access permission.
What versions of Azuriom CMS are affected by CVE-2026-54415?
CVE-2026-54415 affects all versions of Azuriom CMS prior to 1.2.11.