CVE-2026-54415: Azuriom CMS Auth Bypass Vulnerability

CVE-2026-54415 Overview

CVE-2026-54415 is a missing authorization vulnerability in Azuriom CMS affecting versions prior to 1.2.11. The flaw resides in the server management routes defined in routes/admin.php. An authenticated attacker holding the admin.access permission can create AzLink server tokens and abuse the AzLink API endpoints to take over non-admin user accounts. The attacker changes target user passwords and email addresses through crafted HTTP requests to /admin/servers/create, /api/azlink/password, /api/azlink/email, and /api/azlink/user/{id}. The weakness is classified under [CWE-269: Improper Privilege Management].

Critical Impact
An authenticated user with limited admin access can fully compromise non-admin accounts by resetting credentials through unauthorized AzLink API calls.

Affected Products

Azuriom CMS versions before 1.2.11
Installations exposing the AzLink integration endpoints
Deployments where the admin.access permission is delegated to non-trusted operators

Discovery Timeline

2026-06-17 - CVE-2026-54415 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54415

Vulnerability Analysis

The vulnerability stems from missing authorization checks on routes intended exclusively for top-level administrators. Azuriom CMS exposes server provisioning through /admin/servers/create, which generates AzLink tokens used by game server integrations. The AzLink API endpoints /api/azlink/password, /api/azlink/email, and /api/azlink/user/{id} accept these tokens and operate on user records. Any account holding admin.access can both mint a valid token and invoke the user-mutating endpoints, even though such an operator should not be able to modify other administrators or impersonate non-admin users.

Once an attacker resets a victim's email, they can trigger a password recovery, or directly reset the password through /api/azlink/password. This enables full account takeover within the CMS, including any in-game economy, payment history, or moderator privileges tied to the targeted account.

Root Cause

The AzLink server creation and user-management endpoints lacked an authorization policy restricting access to fully-privileged administrators. Possession of admin.access was treated as sufficient to operate sensitive AzLink routes, conflating coarse-grained admin panel access with fine-grained user-management authority.

Attack Vector

The attack requires network access to the Azuriom admin panel and an authenticated session with the admin.access permission. The attacker visits /admin/servers/create to generate an AzLink token, then issues HTTP requests to the AzLink API to alter a victim's email or password. No user interaction from the victim is required, and the change persists immediately.

php

// Patch reference: version bump in app/Azuriom.php
*
* @var string
*/
-    private const VERSION = '1.2.10';
+    private const VERSION = '1.2.11';

/**
* Get the current version of Azuriom CMS.

Source: Azuriom Commit 4b744bc

Detection Methods for CVE-2026-54415

Indicators of Compromise

Unexpected POST requests to /admin/servers/create originating from non-superadmin accounts.
AzLink API calls to /api/azlink/password, /api/azlink/email, or /api/azlink/user/{id} outside of legitimate game-server IP ranges.
Audit log entries showing user email or password changes attributed to AzLink rather than the user or a primary administrator.

Detection Strategies

Correlate AzLink token creation events with subsequent user mutation API calls in a short time window.
Alert on any modification of a user record where the actor identity is an AzLink token rather than an authenticated admin session.
Inspect web server access logs for /api/azlink/* traffic from non-allowlisted source addresses.

Monitoring Recommendations

Forward Azuriom application and web server logs to a centralized analytics platform for retention and review.
Track changes to the users table, especially email and password columns, with database audit triggers.
Review historical activity for accounts that hold the admin.access permission but should not manage user credentials.

How to Mitigate CVE-2026-54415

Immediate Actions Required

Upgrade Azuriom CMS to version 1.2.11 or later without delay.
Review the list of accounts granted the admin.access permission and revoke it where not strictly needed.
Rotate AzLink tokens for all configured servers and reset passwords for any accounts that may have been altered.

Patch Information

The fix is delivered in Azuriom Release v1.2.11. The repository commit 4b744bc bumps the internal version constant and applies the authorization corrections. Refer to the Azuriom GitHub Repository for upgrade instructions.

Workarounds

Restrict network access to /admin/servers/create and /api/azlink/* to known game-server IP addresses via reverse-proxy or web application firewall rules.
Temporarily remove the admin.access permission from any account that is not a fully trusted root administrator.
Audit and invalidate existing AzLink tokens until the upgrade is complete.

bash

# Example nginx restriction for AzLink endpoints
location ~ ^/api/azlink/ {
    allow 203.0.113.10;   # trusted game server
    allow 203.0.113.11;   # trusted game server
    deny all;
    try_files $uri /index.php?$query_string;
}