PT-2026-50444 · Azuriom · Azuriom Cms

Bobur Abdugafforov + 1 · Publicado 2026-06-17 · Atualizado 2026-06-17 · CVE-2026-54415

Mitre

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

Correção

Improper Privilege Management

Missing Authorization

Enumeração de Fraquezas

CWE-269

CWE-862

Identificadores relacionados

CVE-2026-54415

Produtos afetados

Azuriom Cms

Referências · 3

• https://github.com/Azuriom/Azuriom · Nota
• https://github.com/Azuriom/Azuriom/commit/4b744bc0dd11f205f5aa053c6db8a949d3f0608e · Correção
• https://github.com/Azuriom/Azuriom/releases/tag/v1.2.11 · Correção, Aviso do Fabricante