Vulnerability · Published Jun 17, 2026 · Assigned by TuranSec

CVE-2026-54415Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover

High 8.1

In plain English

A high-severity missing authorization in Azuriom CMS from Azuriom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 71.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

Affected products (as reported)

Vendor	Product	Versions
Azuriom	Azuriom CMS	0 – through 1.2.11

Weakness: CWE-862, CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Azuriom CMS v1.2.11 Release vendor-advisory, release-notes, patch
Fixes and improvements (patch commit) patch
Azuriom CMS GitHub Repository product