Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-54415 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

Metrics

CVSS 3.x Severity and Vector Strings:

NDDVolerionCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CNA: TuranSecCVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/Azuriom/Azuriom TuranSecVendor
https://github.com/Azuriom/Azuriom/commit/4b744bc0dd11f205f5aa053c6db8a949d3f0608e TuranSecSource CodeVendor
https://github.com/Azuriom/Azuriom/releases/tag/v1.2.11 TuranSecRelease NotesVendor

Weakness Enumeration

CWE-IDCWE NameSource
CWE-269Improper Privilege ManagementTuranSec
CWE-862Missing AuthorizationTuranSec

Affected Products

ProductVersions
Azuriom
< 1.2.11 (semver)

CPE

  • No CPEs found in CPE dictionary for this product.

Remediation

Change History

3 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-54415
NVD Published Date:
Jun 17, 2026
NVD Last Modified:
Aug 10, 2026
Source:
TuranSec
CVE-2026-54415 Details - Not Deferred