HIGHVulnerability
CVE-2026-54415
Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).
Properties
- severity
- HIGH
- score
- 8.1
- cve_id
- CVE-2026-54415
- vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- published_at
- 2026-06-17T15:17:00.763
- last_modified
- 2026-08-10T12:17:17.707
Related Entities (3)
HAS_WEAKNESS (2)
→[Weakness]Missing Authorization
→[Weakness]Improper Privilege Management
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph