Skip to main content

Anchor CMS CVE-2026-88959

| EUVDEUVD-2026-75572 HIGH
Missing Authorization (CWE-862)
2026-09-10 VulnCheck GHSA-gpm9-mh97-xhwr
Anchor Cms Anchorcms
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-reachable endpoint, no complexity, requires only low-privilege authenticated session, no user interaction; full CIA impact within the application boundary (S:U - same application, no external scope change).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Metadata Corrected
Sep 10, 2026 - 16:40 vuln.today
tag: Authentication Bypass removed
Analysis Generated
Sep 10, 2026 - 16:36 vuln.today
CVSS changed
Sep 10, 2026 - 16:22 NVD
8.8 (HIGH) 8.7 (HIGH)
CVE Published
Sep 10, 2026 - 15:44 cve.org
HIGH 8.7

DescriptionCVE.org

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or admin/users/edit endpoints to create new administrator accounts or change the existing administrator's password, gaining full administrative access.

AnalysisAI

Privilege escalation in Anchor CMS through 0.12.7 allows any authenticated low-privilege user (editor or user role) to create new administrator accounts or hijack the existing administrator's password by directly POSTing to unprotected admin/users/add and admin/users/edit endpoints. The CMS fails to enforce role-based access control at the controller level, meaning the admin user-management routes accept low-privilege session tokens without verifying elevated permissions. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to hold a valid authenticated session in any low-privilege role (editor or user). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the attack profile: network-reachable, no complexity, no attack requirements beyond a low-privilege account, and full system impact once escalated to admin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch has been identified at time of analysis; Anchor CMS appears unmaintained at version 0.12.7. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all Anchor CMS installations running version 0.12.7 or below and immediately restrict administrative interface access to a whitelist of trusted IP addresses. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Anchor Cms

View all
CVE-2024-29499 HIGH POC
7.4 Mar 22

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2. Rated
CVE-2015-5060 MEDIUM POC
6.1 Sep 07

Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev. Rated medium severity (CVSS 6.1), this vulnerabil
CVE-2024-37732 MEDIUM POC
6.1 Jun 24

Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a craft
CVE-2021-44116 MEDIUM POC
6.1 Dec 15

Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Rated medium severity (CVSS 6.1), th
CVE-2025-46041 MEDIUM POC
5.4 Jun 09

A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript

CVE-2022-25576 MEDIUM POC
4.5 Mar 24

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.p
CVE-2014-9182 MEDIUM POC
4.3 Dec 02

models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail message
CVE-2015-5687 HIGH
7.5 Oct 05

system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks an
CVE-2013-5099 LOW POC
2.6 Aug 09

Cross-site scripting (XSS) vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote at
CVE-2024-29338 LOW POC
2.4 Mar 22

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2.

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Share

CVE-2026-88959 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy