CVE-2026-54415: Azuriom CMS Account Takeover via Missing Authorization in Admin Routes

Technical summary

CVE-2026-54415 is a broken access control vulnerability in Azuriom CMS affecting the server administration functionality. The vulnerability exists in routes/admin.php and related AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}). While the attacker must possess valid admin.access permissions and valid authentication credentials, the authorization checks on these endpoints fail to properly validate whether the authenticated user should be permitted to modify arbitrary user accounts. An attacker can craft HTTP requests to /admin/servers/create to generate AzLink server tokens and subsequently use those tokens to invoke API endpoints that modify user credentials without additional consent or verification, leading to unauthorized account takeover of non-admin users.

Business impact

This vulnerability poses a significant risk to organizations running Azuriom CMS, particularly those using it for community management, game servers, or multi-tenant platforms where user account integrity is critical. A rogue or compromised admin account can silently take over any non-admin user account by resetting passwords and hijacking email addresses, enabling fraud, data theft, reputation damage, and loss of user trust. The attack requires no user interaction and leaves minimal audit trails if logging is not properly configured. Affected organizations may face compliance violations, customer support escalation, and potential legal liability depending on data protection regulations in their jurisdiction.

Affected systems

Azuriom CMS versions prior to 1.2.11 on all supported platforms (Windows, Linux, macOS) are vulnerable. The flaw is introduced in the server management and AzLink integration code paths and cannot be mitigated through configuration alone. All instances running versions 1.2.10 and earlier are at risk if administrators with the admin.access permission are present or if credential compromise of such accounts is possible.

Exploitability

Exploitability is moderate to high. The attacker must first obtain or maintain valid admin credentials with the admin.access permission, which narrows the attack surface to insider threats, credential compromise, or organizations where admin privileges are broadly distributed. However, once those credentials are held, the exploitation is trivial—the missing authorization checks mean no additional technical sophistication is required. The attack can be automated and deployed against multiple user accounts in rapid succession. There is no indication this vulnerability is being exploited in the wild at present, but the straightforward nature of the flaw and the high value of user account takeover make it an attractive target for motivated threat actors.

Remediation

Organizations running Azuriom CMS must upgrade to version 1.2.11 or later immediately. This is a critical patch that restores proper authorization enforcement on all affected API endpoints. In addition to patching, security teams should audit admin account activity for any suspicious credential modifications, implement logging and alerting on changes to user passwords and email addresses, and conduct a user notification campaign if account integrity has been compromised. Consider enforcing multi-factor authentication for admin accounts to reduce the risk of credential compromise leading to account takeover attacks.

Patch guidance

Apply Azuriom CMS version 1.2.11 or any subsequent release to all affected instances. Verify the update has been successfully deployed by confirming the version string in the application settings and checking that routes/admin.php has been replaced with the patched version. Test the AzLink API endpoints in a staging environment before full production rollout to ensure no custom integrations are disrupted. Ensure database backups are in place before beginning the upgrade process.

Detection guidance

Monitor application logs and HTTP access logs for suspicious patterns including: (1) multiple requests to /admin/servers/create or /api/azlink/* endpoints in short time windows from the same admin user, particularly outside normal business hours; (2) bulk password or email change requests via the AzLink API; (3) password reset or email change events that lack corresponding user action or consent workflow triggers; (4) admin accounts accessing AzLink endpoints from unusual network locations or IP addresses. Implement alerting on any password or email modification for non-admin user accounts initiated by admin accounts without a corresponding support ticket or audit trail entry. If available, enable detailed API request logging to capture request payloads and response codes.

Why prioritize this

This vulnerability scores 8.1 (HIGH) on CVSS 3.1 and combines high integrity and confidentiality impact with ease of exploitation once admin credentials are obtained. The ability for a single compromised or malicious admin to take over arbitrary user accounts without detection represents a critical threat to multi-user platforms and communities. The attack is silent, scalable, and leaves organizations vulnerable to secondary attacks leveraging hijacked user identities. Although not yet on the KEV catalog, the straightforward nature of the flaw and its direct path to account takeover warrant priority treatment equivalent to critical severity in most risk frameworks.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects a network-accessible vulnerability requiring low privileges (admin.access) with no user interaction. The attack vector is network-based, access complexity is low, and the impact on confidentiality and integrity is high. The attack does not directly degrade system availability, preventing a 9.0+ score. However, the practical risk is elevated by the fact that admin credential compromise is a realistic threat in many organizations, and the consequences of account takeover span financial fraud, data theft, and regulatory violations. Security teams should treat this as a near-critical threat despite the CVSS numerical score.

Frequently asked questions