Azuriom CMS before version 1.2.11 lacks proper authorization checks on its server management routes. An attacker who is already authenticated and possesses the admin.access permission can exploit this flaw to create AzLink server tokens. With these tokens the attacker can modify non-admin user accounts, changing passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints. The result is a full account takeover of non-admin users, compromising confidentiality and integrity of user credentials.

The vulnerability affects Azuriom CMS, all platforms, for all releases prior to 1.2.11.

The CVSS score of 8.6 classifies the flaw as high severity. The EPSS rating of less than 1% indicates a low current likelihood of public exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, an attacker must be authenticated and carry the admin.access permission; once these prerequisites are met, the exploitation path is straightforward with standard HTTP requests, making the risk significant for organizations with exposed Azuriom installations.