CVE-2026-54415: Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover

Synopsis

Broken access control in Azuriom CMS (versions before 1.2.11) allows an authenticated attacker who holds the admin.access permission to exceed their intended privileges via crafted HTTP requests to server management and AzLink API routes. The vulnerability is reachable over the network with no additional prerequisites beyond a low-privilege account carrying that permission, requiring no victim interaction. Successful exploitation lets the attacker create AzLink server tokens and take over arbitrary non-admin user accounts by overwriting their passwords and email addresses. A patched-image rebuild at version 1.2.11 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Azuriom CMS application over the network to send crafted HTTP requests to the affected admin and AzLink API routes.

• AuthenticationRequired

  A valid account holding the admin.access permission is needed; any low-privilege account with that permission is sufficient, and no administrator-level account is required.

• Victim interactionNot required

  No victim action is needed; the attacker sends crafted requests directly to the server without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no race conditions or special environmental conditions on the attacker.

Blast Radius

• The attacker reads account details for any non-admin user by querying AzLink API endpoints, exposing stored email addresses and associated profile data.
• The attacker overwrites the password and email address of targeted non-admin accounts, seizing full control of those accounts.
• The attacker creates AzLink server tokens, gaining persistent API-level access to linked game servers managed through the CMS.
• Integrity of the user database is compromised across all non-admin accounts the attacker chooses to target.