CVE-2026-88959 in Anchor CMS
Summary
by MITRE • 09/10/2026
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or admin/users/edit endpoints to create new administrator accounts or change the existing administrator's password, gaining full administrative access.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in Anchor CMS versions through 0.12.7 represents a critical failure in role-based access control mechanisms within the application administration interface. This flaw specifically affects user management endpoints that are intended to be restricted to users with elevated privileges, such as administrators. The core technical issue lies in the server-side validation logic which fails to verify whether the authenticated session possesses the necessary permissions before processing requests related to account creation or modification. Consequently, the access control checks are either missing entirely or implemented incorrectly, allowing any user who has successfully authenticated to the system to bypass these restrictions regardless of their assigned role level.
From a technical perspective, an attacker with low-privilege credentials, such as those associated with editor or standard user roles, can exploit this weakness by sending direct HTTP POST requests to specific administrative endpoints like admin/users/add and admin/users/edit. By manipulating these request parameters, the attacker is able to create new accounts that are explicitly assigned administrator privileges or alter existing high-level accounts, including changing passwords for current administrators. This bypass of authorization controls effectively neutralizes the security boundary between low-privilege users and system owners, granting the attacker full administrative access to the content management platform without requiring privilege escalation through other means such as exploiting separate code execution flaws.
The operational impact of this vulnerability is severe, as it leads directly to a complete compromise of the targeted web application's integrity and confidentiality. Once an attacker gains administrator privileges via this method, they can perform any action available to the system owner, including modifying website content, installing malicious plugins or themes, accessing sensitive database information, and potentially achieving remote code execution depending on how the CMS handles uploaded files or executes scripts. This level of access allows for persistent backdoors, data exfiltration, defacement, and further lateral movement if the underlying server infrastructure is not properly segmented from other critical systems.
This vulnerability aligns with CWE-269, which describes Improper Privilege Control, as it involves a failure to enforce proper authorization checks on sensitive operations. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK technique T1078, Valid Accounts, where attackers use legitimate credentials to gain access and subsequently escalate privileges within the environment by exploiting misconfigurations rather than technical exploits in code logic. The exploitation path is straightforward and does not require complex chaining with other vulnerabilities, making it a high-risk issue for any deployment of this software version that exposes administrative interfaces to authenticated users.
To mitigate this risk, immediate action must be taken to upgrade Anchor CMS to the latest patched version where these access control checks have been corrected by the developers. For organizations unable to patch immediately due to compatibility constraints or other operational factors, a temporary workaround involves restricting network-level access to the admin interface using firewall rules or reverse proxy configurations that limit visibility only to trusted IP addresses associated with legitimate administrators. Additionally, implementing multi-factor authentication for all administrative accounts can reduce the likelihood of credential compromise leading to this type of privilege escalation, although it does not fix the underlying authorization flaw within the application itself. Regular security audits and penetration testing should be conducted to identify similar access control deficiencies in other parts of the web application infrastructure.