Executive brief
Anchor CMS, a lightweight content management system, fails to properly verify user roles when managing administrator accounts. Any authenticated user with basic editor or user permissions can directly create new administrator accounts or modify existing ones, gaining full control of the CMS and potentially the underlying server.
Technical details
This is a missing authorization vulnerability (CWE-862) in Anchor CMS user-management endpoints. While the application correctly verifies that requests are authenticated, it fails to enforce role-based access control on the /admin/users/add and /admin/users/edit/{id} endpoints in anchor/routes/users.php. Low-privilege authenticated users (editors, contributors) can directly POST to these endpoints to create new administrator accounts or modify existing administrator credentials. The vulnerability requires authentication but no special privileges to exploit, making it a straightforward privilege escalation path to full administrative control.
Affected products
- Anchor Anchor CMS through 0.12.7
Timeline
- 2026-09-10: disclosed: CVE-2026-88959 published
- 2026-09-03: other: Vulnerability independently discovered and reported to VulnCheck