Vendor
Anchor CMS versions 0.12.7 and earlier contain an improper access control vulnerability (CVE-2026-88959) allowing authenticated low-privileged users to escalate privileges by modifying administrative accounts.