CyberRota Analysis
AI-GeneratedAnchor CMS versions up to 0.12.7 are vulnerable due to inadequate role-based access control in the admin user-management endpoints, allowing authenticated low-privilege users to create or modify administrator accounts. This flaw enables attackers with editor or user roles to gain full administrative access, posing a significant security risk. Organizations using Anchor CMS should prioritize patching this vulnerability to prevent unauthorized account escalations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or admin/users/edit endpoints to create new administrator accounts or change the existing administrator's password, gaining full administrative access.