CVE-2026-54415CWE-269CWE-862broken-access-controlprivilege-escalation

CVE-2026-54415

High · published June 17, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00488 · 41.0th percentile
Weaknesses
CWE-269 · Improper Privilege Management; CWE-862 · Missing Authorization
Published
2026-06-17T19:17Z
References (3)
https://github.com/Azuriom/Azuriom · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/Azuriom/Azuriom/commit/4b744bc0dd11f205f5aa053c6db8a949d3f0608e · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/Azuriom/Azuriom/releases/tag/v1.2.11 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 17 JUN 14:04Z
    Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover
    cvelistv5