What’s Vulnerable › Vulnerabilities

CVE-2026-63727: Anchore Enterprise Privilege Escalation via User Management API

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-28 · updated 2026-10-24
• Weakness: CWE-648

Description

Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to additional resources and operations. It is not possible to grant the system-admin role, but a read only user could be granted write access. This issue is fixed in Anchore Enterprise 5.27.2 and 6.0.1.

Affected products

• Anchore Enterprise: from 5.11.0 before 5.27.2; from 6.0.0 before 6.0.1 — fixed in 5.27.2, 6.0.1

How to fix

Upgrade to a fixed version: Anchore Enterprise 5.27.2, 6.0.1. Check the vendor advisory for mitigations.

References

• https://docs.anchore.com/5.27/docs/release_notes/enterprise/5272/
• https://www.vulncheck.com/advisories/anchore-enterprise-privilege-escalation-via-user-management-api

Get alerted when CVE-2026-63727 or the next vulnerability affects your stack