---
id: CVE-2026-54415
title: >-
  Missing Authorization in the server management routes (routes/admin.php) in
  Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated
  attacker with the admin.access permission to create AzLink server tokens and
  take over…
summary: >-
  Missing Authorization in the server management routes (routes/admin.php) in
  Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated
  attacker with the admin.access permission to create AzLink server tokens and
  take over…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-269
  - CWE-862
published: '2026-06-17'
updated: '2026-08-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54415'
references:
  - url: 'https://github.com/Azuriom/Azuriom'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
  - url: >-
      https://github.com/Azuriom/Azuriom/commit/4b744bc0dd11f205f5aa053c6db8a949d3f0608e
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
  - url: 'https://github.com/Azuriom/Azuriom/releases/tag/v1.2.11'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
tags:
  - nvd
  - exploit-available
epss: 0.00488
epssPercentile: 0.39393
ingestedAt: '2026-08-10T12:39:46.938Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/abdugafforov-bobur/CVE-2026-54415-PoC'
  checkedAt: '2026-09-26T09:05:49.460Z'
exploitAvailable: true
---

## Overview

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.