Description
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or admin/users/edit endpoints to create new administrator accounts or change the existing administrator's password, gaining full administrative access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| anchorcms | Anchor CMS | ≤ 0.12.7 | — |
References
- Anchor CMS 0.12.7 - Missing Authorization / Privilege Escalation third-party-advisory
- anchor/routes/users.php at 0.12.7 technical-description
- Product product
- VulnCheck Advisory: Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints third-party-advisory