Improper Access Control in Anchor CMS User Management

Anchor CMS versions 0.12.7 and earlier are vulnerable to a critical access control flaw in the administration module. The application fails to properly enforce role-based access control (RBAC) on user management endpoints. An authenticated user possessing a low-privilege role, such as editor or user, can bypass authorization checks to perform administrative actions. By sending a crafted POST request to specific management endpoints, an attacker can create new administrator accounts or modify the password of an existing administrator. This vulnerability allows for immediate privilege escalation to full administrative control over the CMS instance, facilitating complete site compromise, data exfiltration, or content modification.

Attack Chain

1. Attacker obtains valid credentials for a low-privilege account (e.g., editor or user role) via phishing or credential stuffing.
2. Attacker logs into the Anchor CMS instance using the compromised low-privilege credentials.
3. Attacker discovers the admin/users/add or admin/users/edit endpoints through manual analysis of the application structure.
4. Attacker crafts a POST request targeting the admin/users/add endpoint to inject a new user with an administrator flag.
5. Alternatively, the attacker sends a POST request to the admin/users/edit endpoint to modify the credentials of an existing administrator account.
6. The application backend fails to validate the current user's administrative role, processing the request and updating the database accordingly.
7. The attacker authenticates as the newly created administrator or with the hijacked account credentials.
8. Final objective achieved: full administrative access is granted, allowing for site-wide configuration changes or data manipulation.

Impact

Successful exploitation leads to full unauthorized administrative access to the affected CMS instance. Attackers can leverage this to modify site content, extract database information, or gain persistence within the server environment. This vulnerability affects all instances running versions 0.12.7 and earlier.

Recommendation

Prioritized actions for administrators of the affected software:

• Immediately audit administrative user accounts for unauthorized additions or unexpected modifications (check application logs for requests to the admin/users/ endpoints).
• Restrict access to the Anchor CMS administration interface to known-secure management IP ranges via firewall/WAF.
• Monitor web application logs for POST requests to "/admin/users/add" and "/admin/users/edit" originating from low-privilege user sessions.
• Upgrade Anchor CMS to the latest version once a patch addressing CVE-2026-88959 is released by the maintainers.