CVE-2026-19975: Time-of-check Time-of-use in Azuriom CMS
A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-check time-of-use. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. Upgrading to version 1.2.13 is capable of addressing this issue. Patch name: ae5596a9548e010a8a79838806eff60ef9554539. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
AI Analysis
Technical Summary
This vulnerability involves a TOCTOU race condition in the transferMoney function of Azuriom CMS's ProfileController.php file, which handles money transfers. The flaw allows an attacker to manipulate the timing between the check and use of a resource, potentially leading to inconsistent or unauthorized operations. Exploitation requires remote access and is complex. The vendor has released version 1.2.13 to fix this issue, identified by patch ae5596a9548e010a8a79838806eff60ef9554539.
Potential Impact
The vulnerability could allow an attacker to exploit a race condition in the money transfer process, potentially causing inconsistent or unauthorized money transfers. However, the attack complexity is high, and the exploitability is difficult, resulting in a low severity impact as per the CVSS score of 2.3. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade Azuriom CMS to version 1.2.13 or later, which contains the official fix for this TOCTOU vulnerability. No other mitigations are indicated or necessary given the availability of this patch.
CVE-2026-19975: Time-of-check Time-of-use in Azuriom CMS
Description
A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-check time-of-use. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. Upgrading to version 1.2.13 is capable of addressing this issue. Patch name: ae5596a9548e010a8a79838806eff60ef9554539. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
CVSS v4.0
Score 2.3low
Affected software
Azuriom
CMS
pkg:github/azuriom/Azuriomcpe:2.3:a:azuriom:cms:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a TOCTOU race condition in the transferMoney function of Azuriom CMS's ProfileController.php file, which handles money transfers. The flaw allows an attacker to manipulate the timing between the check and use of a resource, potentially leading to inconsistent or unauthorized operations. Exploitation requires remote access and is complex. The vendor has released version 1.2.13 to fix this issue, identified by patch ae5596a9548e010a8a79838806eff60ef9554539.
Potential Impact
The vulnerability could allow an attacker to exploit a race condition in the money transfer process, potentially causing inconsistent or unauthorized money transfers. However, the attack complexity is high, and the exploitability is difficult, resulting in a low severity impact as per the CVSS score of 2.3. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade Azuriom CMS to version 1.2.13 or later, which contains the official fix for this TOCTOU vulnerability. No other mitigations are indicated or necessary given the availability of this patch.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-16T08:56:10.076Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a827876bf8831d5391b2c1f
Added to database: 08/17/2026, 02:56:54 UTC
Last enriched: 08/24/2026, 12:46:31 UTC
Last updated: 10/01/2026, 05:08:50 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.