admin user-management endpoints has an access control flaw

Published September 10, 2026 CVE-2026-88959

Anchor CMS lets any logged-in low-privilege user create an administrator account or change an existing administrator's password. That can give the attacker full administrative access to the site.

Severity
HighCVSS 3.1 · 8.8
Fix
Not confirmedLast checked today
Affected versions
through 0.12.7
Weakness
CWE-862Missing Authorization
Exploit likelihood
0.29% in 30 daysEPSS, higher than 21% of known flaws
Affects
Anchor CMS
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75572ENISA vulnerability database

How it works

  • The attacker must first have a valid Anchor CMS account, such as an editor or user account.
  • They send requests to the site's user-management routes.
  • Anchor CMS checks that they are logged in but does not confirm administrator privileges.
  • These routes can create administrator accounts or change another user's password.

What to do

Check the installed Anchor CMS version and compare it with the VulnCheck advisory. Versions through 0.12.7 are in scope.

Technical details

Affected software: Anchor CMSPHP package by anchorcms

CVE-2026-88959 affects Anchor CMS's administrative user-management routes. They require authentication but do not require an administrator role, and account creation or editing assigns administrator privileges.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source