Azuriom CMS up to 1.2.10 AzLink API routes/admin.php authorization

Summaryinfo

A vulnerability identified as critical has been detected in Azuriom CMS up to 1.2.10. This affects an unknown function of the file routes/admin.php of the component AzLink API. The manipulation leads to authorization. This vulnerability is uniquely identified as CVE-2026-54415. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Azuriom CMS up to 1.2.10. This issue affects some unknown functionality of the file routes/admin.php of the component AzLink API. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

The weakness was disclosed by Bobur Abdugafforov. The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-54415 since 06/13/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

By approaching the search of inurl:routes/admin.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.2.11 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• Azuriom

Name

• CMS

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion