CVE-2026-88959 anchorcms CVE debrief

Who should care

Defenders and administrators of Anchor CMS deployments should assess exposure and prioritize remediation, especially for systems with untrusted or low-privilege user access. They should verify Anchor CMS version and check for updates to 0.12.8 or later, restrict access to admin user-management endpoints, and monitor for suspicious activity on user accounts and admin endpoints.

Why it matters

CVE-2026-88959 allows low-privilege users to create administrator accounts or modify existing ones in Anchor CMS 0.12.7, requiring defenders to verify and remediate this vulnerability.

• Potential elevation of privileges for low-privilege users
• Possible creation of unauthorized administrator accounts
• Modification of existing administrator accounts
• Verification of Anchor CMS version and remediation priority

Technical summary

Anchor CMS 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing low-privilege users to create administrator accounts or modify existing ones. This vulnerability enables attackers with editor or user roles to potentially gain full administrative access by directly accessing admin/users/add or admin/users/edit endpoints. Defenders should prioritize verifying and remediating this vulnerability in Anchor CMS deployments, especially for systems with untrusted or low-privilege user access.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Anchor CMS deployments, especially for systems with untrusted or low-privilege user access.

Recommended defensive actions

• Verify Anchor CMS version and check for updates to 0.12.8 or later
• Restrict access to admin user-management endpoints
• Monitor for suspicious activity on user accounts and admin endpoints
• Implement role-based access control for admin users
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.7 and the lack of role-based access control in Anchor CMS 0.12.7. The vulnerability allows low-privilege users to create administrator accounts or modify existing ones. Defenders should verify and remediate this vulnerability, especially for systems with untrusted or low-privilege user access. The CVE record was published on 2026-09-10T16:18:12.843Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.