{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aanchor_cmsanchor_cms/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:anchor_cms:anchor_cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-88959"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Anchor CMS (\u003c= 0.12.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Anchor CMS"],"content_html":"\u003cp\u003eAnchor CMS versions 0.12.7 and earlier are vulnerable to a critical access control flaw in the administration module. The application fails to properly enforce role-based access control (RBAC) on user management endpoints. An authenticated user possessing a low-privilege role, such as editor or user, can bypass authorization checks to perform administrative actions. By sending a crafted POST request to specific management endpoints, an attacker can create new administrator accounts or modify the password of an existing administrator. This vulnerability allows for immediate privilege escalation to full administrative control over the CMS instance, facilitating complete site compromise, data exfiltration, or content modification.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains valid credentials for a low-privilege account (e.g., editor or user role) via phishing or credential stuffing.\u003c/li\u003e\n\u003cli\u003eAttacker logs into the Anchor CMS instance using the compromised low-privilege credentials.\u003c/li\u003e\n\u003cli\u003eAttacker discovers the admin/users/add or admin/users/edit endpoints through manual analysis of the application structure.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a POST request targeting the admin/users/add endpoint to inject a new user with an administrator flag.\u003c/li\u003e\n\u003cli\u003eAlternatively, the attacker sends a POST request to the admin/users/edit endpoint to modify the credentials of an existing administrator account.\u003c/li\u003e\n\u003cli\u003eThe application backend fails to validate the current user's administrative role, processing the request and updating the database accordingly.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates as the newly created administrator or with the hijacked account credentials.\u003c/li\u003e\n\u003cli\u003eFinal objective achieved: full administrative access is granted, allowing for site-wide configuration changes or data manipulation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to full unauthorized administrative access to the affected CMS instance. Attackers can leverage this to modify site content, extract database information, or gain persistence within the server environment. This vulnerability affects all instances running versions 0.12.7 and earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for administrators of the affected software:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit administrative user accounts for unauthorized additions or unexpected modifications (check application logs for requests to the admin/users/ endpoints).\u003c/li\u003e\n\u003cli\u003eRestrict access to the Anchor CMS administration interface to known-secure management IP ranges via firewall/WAF.\u003c/li\u003e\n\u003cli\u003eMonitor web application logs for POST requests to \u0026quot;/admin/users/add\u0026quot; and \u0026quot;/admin/users/edit\u0026quot; originating from low-privilege user sessions.\u003c/li\u003e\n\u003cli\u003eUpgrade Anchor CMS to the latest version once a patch addressing CVE-2026-88959 is released by the maintainers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-10T17:07:50Z","date_published":"2026-09-10T17:07:50Z","id":"https://feed.craftedsignal.io/briefs/2026-09-anchor-cms-privilege-escalation/","summary":"Anchor CMS versions 0.12.7 and earlier contain an improper access control vulnerability (CVE-2026-88959) allowing authenticated low-privileged users to escalate privileges by modifying administrative accounts.","title":"Improper Access Control in Anchor CMS User Management","url":"https://feed.craftedsignal.io/briefs/2026-09-anchor-cms-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:anchor_cms:anchor_cms:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}