https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T17:54:16.761735+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54415 CVE-2026-54415 — Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover 2026-10-08T17:54:16.776782+00:00

Affected: Azuriom CMS

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).