Which versions of Azuriom CMS are affected by CVE-2026-54415?

Azuriom CMS versions before 1.2.11 allow authenticated administrators to hijack non-admin user accounts by modifying passwords and email addresses through unprotected API endpoints.. A patch is available.

How to fix or mitigate CVE-2026-54415?

Within 24 hours, audit all Azuriom CMS deployments to identify running versions and determine which systems are at risk. Within 7 days, upgrade all instances running versions prior to 1.2.11 to version 1.2.11 or later, beginning with production environments. Within 30 days, review access logs for the affected API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}) to identify any suspicious account modifications, reset credentials for any potentially compromised user accounts, and implement monitoring to detect future unauthorized account changes.

Azuriom CMS CVE-2026-54415

Q: What is the CVSS score of CVE-2026-54415?

CVE-2026-54415 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Missing Authorization (CWE-862)

2026-06-17 TuranSec

PHP Authentication Bypass Azuriom Azuriom Cms

8.6

CVSS 4.0 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Network vector via HTTP API; PR:L for required admin.access role; S:C because attacker compromises security context of other user accounts beyond their own.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 10, 2026 - 12:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 10, 2026 - 12:22 vuln.today

cvss_changed

CVSS changed

Aug 10, 2026 - 12:22 NVD

8.1 (HIGH) 8.6 (HIGH)

Source Code Evidence Fetched

Jun 17, 2026 - 15:32 vuln.today

Analysis Generated

Jun 17, 2026 - 15:32 vuln.today

CVE Published

Jun 17, 2026 - 14:04 cve.org

HIGH 8.1

DescriptionCVE.org

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

AnalysisAI

Missing authorization in Azuriom CMS before 1.2.11 allows an authenticated attacker holding the admin.access permission to abuse unprotected AzLink server management routes to create server tokens and subsequently take over arbitrary non-admin user accounts by overwriting their passwords and email addresses. The vulnerability resides in routes/admin.php and exposes three AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}) that fail to enforce a higher privilege boundary beyond admin.access. No active exploitation is confirmed (not in CISA KEV, EPSS 0.35%/26th percentile), and a vendor patch was released in v1.2.11.

Technical ContextAI

Azuriom is an open-source PHP-based game server CMS that includes AzLink, an integration layer for connecting game servers to the CMS. The vulnerable code in routes/admin.php defines server management endpoints that gate entry on the admin.access permission check alone, without a secondary authorization assertion for the more privileged operations of creating AzLink authentication tokens and invoking user-management API methods. CWE-862 (Missing Authorization) describes precisely this pattern: authentication is enforced but the application fails to verify that the authenticated identity is authorized to perform the specific action requested. The CPE cpe:2.3:a:azuriom:azuriom_cms:*:*:*:*:*:*:*:* covers all platform variants (Linux, Windows, macOS) since the vulnerability is in platform-agnostic PHP routing logic. The AzLink API surface - /api/azlink/password, /api/azlink/email, and /api/azlink/user/{id} - was intended for server-to-CMS synchronization but becomes an account-manipulation primitive when an attacker can self-issue a valid AzLink token.

RemediationAI

The primary remediation is upgrading to Azuriom CMS 1.2.11, which includes a 'Fix missing permissions' changelog entry corresponding to this authorization gap. The release is available at https://github.com/Azuriom/Azuriom/releases/tag/v1.2.11 and the precise code change is at commit https://github.com/Azuriom/Azuriom/commit/4b744bc0dd11f205f5aa053c6db8a949d3f0608e. As a compensating control prior to patching, administrators should audit who holds the admin.access role and restrict it to fully trusted operators only, since the attack requires this role. Additionally, network-layer controls that block unanticipated access to /admin/servers/create and the /api/azlink/* endpoints from untrusted network segments can reduce exposure, though these controls do not prevent abuse by a legitimate internal admin.access holder.