CVE-2026-88959 PUBLISHED

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or admin/users/edit endpoints to create new administrator accounts or change the existing administrator's password, gaining full administrative access.

• Barno Bozorova reporter

• Anchor CMS 0.12.7 - Missing Authorization / Privilege Escalation
• anchor/routes/users.php at 0.12.7
• Product
• VulnCheck Advisory: Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints

• Missing Authorization CWE