Anchor CMS version 0.12.7 and earlier lack proper role‑based access control on the admin user‑management endpoints. The system does not verify that a caller has the administrator role before allowing account creation or password changes. Consequently, an attacker who has authenticated with a low‑privilege account, such as editor or user, can send POST requests to the /admin/users/add or /admin/users/edit routes and create new administrator accounts or alter the credentials of existing administrators. The attacker then gains full administrative privileges, enabling complete control over the CMS, including configuration changes and content manipulation.

Vulnerable deployments are Anchor CMS 0.12.7 and earlier. The issue affects any instance that exposes the /admin/users/add and /admin/users/edit endpoints to authenticated users without enforcing administrator‑only access.

The vulnerability carries a CVSS score of 8.7, classified as high severity. EPSS information is not available, and the issue is not listed in CISA’s known exploited vulnerabilities catalog. Exploitation requires only that the attacker be logged in with a non‑administrator role; no additional access or external conditions are needed. An attacker can directly POST to the user‑management endpoints to create password, effectively achieving a full compromise of the CMS.