Azuriom Cms
Monthly
Missing authorization in Azuriom CMS before 1.2.11 allows an authenticated attacker holding the admin.access permission to abuse unprotected AzLink server management routes to create server tokens and subsequently take over arbitrary non-admin user accounts by overwriting their passwords and email addresses. The vulnerability resides in routes/admin.php and exposes three AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}) that fail to enforce a higher privilege boundary beyond admin.access. No active exploitation is confirmed (not in CISA KEV, EPSS 0.35%/26th percentile), and a vendor patch was released in v1.2.11.
Missing authorization in Azuriom CMS before 1.2.11 allows an authenticated attacker holding the admin.access permission to abuse unprotected AzLink server management routes to create server tokens and subsequently take over arbitrary non-admin user accounts by overwriting their passwords and email addresses. The vulnerability resides in routes/admin.php and exposes three AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}) that fail to enforce a higher privilege boundary beyond admin.access. No active exploitation is confirmed (not in CISA KEV, EPSS 0.35%/26th percentile), and a vendor patch was released in v1.2.11.