Executive brief
Azuriom CMS, a web platform used for managing game servers, contains a security flaw in its server management routes. An attacker with basic administrative access can bypass intended restrictions to create unauthorized server tokens. This allows them to take over other user accounts by changing their email addresses and passwords, potentially leading to a full compromise of the gaming community's user data.
Technical details
A missing authorization vulnerability exists in the server management routes (specifically routes/admin.php) of Azuriom CMS. An authenticated attacker possessing the 'admin.access' permission can send crafted HTTP requests to /admin/servers/create to generate AzLink server tokens. Using these tokens, the attacker can interact with AzLink API endpoints (/api/azlink/password, /api/azlink/email, and /api/azlink/user/{id}) to modify the credentials of non-admin users. This effectively allows for account takeover and unauthorized data modification. The issue is resolved in version 1.2.11.
Affected products
- Azuriom Azuriom CMS < 1.2.11
Timeline
- 2026-06-08: patched: Fix committed and version 1.2.11 released.
- 2026-06-17: disclosed: CVE published to NVD.