CVE-2026-88959 Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints
Low-privilege users can create admin accounts or modify passwords due to missing authorization checks on user management endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88959?
CVE-2026-88959 is a high-severity missing authorization vulnerability in anchorcms Anchor CMS, published on 10 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or admin/users/edit endpoints to create new administrator accounts or change the existing administrator's password, gaining full administrative access.
Weakness: CWE-862
Which versions are affected by CVE-2026-88959?
How do I fix CVE-2026-88959?
No fix has been published for CVE-2026-88959 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-88959 being exploited?
There is no known exploitation of CVE-2026-88959 in the wild and no public exploit code.
Sources
Also known as GHSA-gpm9-mh97-xhwr.