PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54415 Azuriom CVE debrief

The CVE-2026-54415 vulnerability affects Azuriom CMS versions prior to 1.2.11. An authenticated attacker with 'admin.access' permission can exploit this issue by creating AzLink server tokens and taking over non-admin user accounts. This is achieved through crafted HTTP requests to specific endpoints, including '/admin/servers/create' and various AzLink API endpoints. The vulnerability has a CVSS score of 8.6, indicating a high severity level. Users of Azuriom CMS should update to version 1.2.11 or later to mitigate this risk.

Vendor
Azuriom
Product
Azuriom CMS
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-08-10
Advisory published
2026-06-17
Advisory updated
2026-08-10

Who should care

Administrators and users of Azuriom CMS, especially those with 'admin.access' permissions, should be aware of this vulnerability and take immediate action to update their installations. Additionally, users who have accounts on Azuriom CMS instances should be cautious of potential account takeover attempts.

Technical summary

The vulnerability is caused by missing authorization in the server management routes (routes/admin.php) of Azuriom CMS before version 1.2.11. An authenticated attacker with 'admin.access' permission can exploit this by sending crafted HTTP requests to '/admin/servers/create' and AzLink API endpoints, such as '/api/azlink/password', '/api/azlink/email', and '/api/azlink/user/{id}'. This allows the attacker to create AzLink server tokens and modify non-admin user accounts by changing their passwords and email addresses.

Defensive priority

High

Recommended defensive actions

  • Update Azuriom CMS to version 1.2.11 or later immediately.
  • Restrict access to server management routes and AzLink API endpoints.
  • Monitor for suspicious activity, especially account changes and new AzLink server tokens.
  • Implement additional authentication and authorization checks for admin actions.
  • Regularly review and update user permissions and access levels.
  • Consider implementing a Web Application Firewall (WAF) to detect and prevent similar attacks.

Evidence notes

The information provided is based on the CVE-2026-54415 record and related sources from NVD and GitHub. The vulnerability was published on June 17, 2026, and the information provided seems reliable. However, the actual impact and exploitability may vary depending on specific configurations and usage scenarios of Azuriom CMS.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54415 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54415

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54415 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54415

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Azuriom/Azuriom

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Azuriom/Azuriom/commit/4b744bc0dd11f205f5aa053c6db8a949d3f0608e

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Azuriom/Azuriom/releases/tag/v1.2.11

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.