Is there a patch available for CVE-2026-19975?

Yes, a patch is available for CVE-2026-19975. Update the affected software to the latest version immediately.

Azuriom CMS CVE-2026-19975

Q: What is the CVSS score of CVE-2026-19975?

CVE-2026-19975 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-60035 LOW

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-08-17 VulDB

GHSA-m9j6-2rfj-56fw

PHP Information Disclosure Azuriom Cms

1.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

Network-exploitable race condition requiring authenticated low-privilege user and precise timing; integrity-only impact limited to in-game currency manipulation.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 03:22 NVD

2.3 (LOW) 1.3 (LOW)

Source Code Evidence Fetched

Aug 17, 2026 - 03:14 vuln.today

Analysis Generated

Aug 17, 2026 - 03:14 vuln.today

DescriptionCVE.org

A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-check time-of-use. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. Upgrading to version 1.2.13 is capable of addressing this issue. Patch name: ae5596a9548e010a8a79838806eff60ef9554539. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.

AnalysisAI

Race condition in Azuriom CMS up to v1.2.12 allows authenticated users to exploit a time-of-check time-of-use (TOCTOU) flaw in the money transfer handler, potentially duplicating in-game currency by submitting concurrent transfer requests that each pass the balance check before any deduction is applied. The commit diff confirms the vulnerability in ProfileController.php::transferMoney(), where a balance check was performed outside any database transaction lock. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental metric E:P indicates proof-of-concept code exists. Attack complexity is rated high due to the narrow timing window required to win the race.

Technical ContextAI

The flaw is classified as CWE-367 (TOCTOU Race Condition) in a PHP Laravel application. The affected code in app/Http/Controllers/ProfileController.php executed a balance check (if ($user->money < $money)) and then performed debit/credit operations (removeMoney/addMoney) as separate, unlocked database queries. Without a transaction lock, two concurrent requests could both pass the balance check before either deduction committed, resulting in an effective currency duplication. The fix wraps the check-and-transfer in a DB::transaction() block with lockForUpdate(), acquiring a row-level pessimistic lock on the sender's user record. Affected product identified via CPE: cpe:2.3:a:azuriom:cms:*:*:*:*:*:*:*:* for versions up to and including 1.2.12.

RemediationAI

Upgrade Azuriom CMS to version 1.2.13, which resolves the race condition by wrapping the balance check and transfer operations in a database transaction with a pessimistic row lock. The fix is confirmed in commit ae5596a9548e010a8a79838806eff60ef9554539 at https://github.com/Azuriom/Azuriom/commit/ae5596a9548e010a8a79838806eff60ef9554539 and tagged in the v1.2.13 release at https://github.com/Azuriom/Azuriom/releases/tag/v1.2.13. As a short-term workaround prior to patching, administrators can disable the money transfer feature entirely via the CMS economy settings, which eliminates the attack surface with no other side effects. Rate-limiting the money transfer endpoint at the web server or application layer would reduce but not eliminate exploitation risk, as the race window can potentially be hit even with modest concurrency.