Skip to content
OpenAdvisories
High · 8.1 Public exploit CVE-2026-54415 EUVD-2026-37721GHSA-3h94-x92g-h9g5

Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover

Published Jun 17, 2026 · Updated Aug 10, 2026 · Assigned by TuranSec

Vendor: Azuriom Product: Azuriom CMS

Description

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

Affected products

VendorProductAffectedFixed
Azuriom Azuriom CMS ≤ 1.2.11 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References