A time‑of‑check, time‑of‑use race condition was found in the transferMoney routine of Azuriom CMS’s Money Transfer Handler. An attacker can manipulate request timing to have the function perform a transfer based on stale data, potentially moving funds without proper authorization. The flaw is remote‑triggerable but requires high complexity and is considered difficult to exploit.

The vulnerability affects Azuriom CMS versions up to and including 1.2.12. Any instance using these releases and the transferMoney method is impacted. The fix is included in version 1.2.13, identified by patch commit ae5596a9548e010a8a79838806eff60ef9554539. Administrators should ensure the CMS is upgraded to at least 1.2.13.

The CVSS score of 2.3 indicates low overall severity, and no EPSS or KEV listing means the exploitation probability is not currently quantified or widely reported. Nonetheless the remote nature of the trigger and the potential for financial loss make it a non‑trivial risk. Attackers would need to time the request precisely, and the difficulty score suggests that successfully carrying out a transfer likely requires specialized knowledge or automated tooling.