CVE-2026-88959: Anchorcms Anchor CMS

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or admin/users/edit endpoints to create new administrator accounts or change the existing administrator's password, gaining full administrative access.

Affected products

• Anchorcms Anchor CMS: up to and including 0.12.7

Published 2026-09-10. Last modified 2026-09-11.