CVE-2026-54415: Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-17 · updated 2026-10-26
Weakness: CWE-269

Description

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

Affected products

Azuriom CMS: through 1.2.11

References

https://github.com/Azuriom/Azuriom
https://github.com/Azuriom/Azuriom/commit/4b744bc0dd11f205f5aa053c6db8a949d3f0608e
https://github.com/Azuriom/Azuriom/releases/tag/v1.2.11

Get alerted when CVE-2026-54415 or the next vulnerability affects your stack