CVE-2026-88959

Anchor CMS through version 0.12.7 fails to enforce authorization (CWE-862) on its admin user-management endpoints, so the platform's role-based access control is not actually applied when accounts are created or edited. Any authenticated user with a low-privilege role, such as editor or user, can send a POST request directly to the admin/users/add or admin/users/edit endpoints, bypassing the intended permission checks. By doing so, the attacker can create a brand-new administrator account or change the existing administrator's password, thereby obtaining full administrative control of the CMS, which carries high impact per the assigned CVSS 4.0 score of 8.7. All Anchor CMS deployments running version 0.12.7 or earlier are affected, particularly multi-user installations where low-privilege accounts exist or can be created. There is no indication of active exploitation in the wild, no entry in CISA's KEV, and no public proof-of-concept is known at this time.

What to do: Upgrade Anchor CMS to a patched release newer than 0.12.7 as soon as one is published, and verify that admin/users/add and admin/users/edit are restricted to the administrator role. As an interim mitigation, block or limit POST access to those endpoints for non-administrator users (e.g., via web server or WAF rules) and audit the administrator account list plus recent admin password changes for signs of unauthorized account creation or takeover.