CVE-2026-63727: Incorrect Use of Privileged APIs in Anchore Anchore Enterprise
Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to additional resources and operations. It is not possible to grant the system-admin role, but a read only user could be granted write access. This issue is fixed in Anchore Enterprise 5.27.2 and 6.0.1.
AI Analysis
Technical Summary
CVE-2026-63727 is an improper privilege escalation vulnerability in Anchore Enterprise's user management API affecting versions 5.11.0 to 5.27.1 and 6.0.0. An authenticated attacker with API access can issue calls that modify user permissions, elevating privileges from read-only to write access. The flaw does not allow granting the system-admin role. The issue is resolved in versions 5.27.2 and 6.0.1.
Potential Impact
An authenticated attacker with access to the Anchore Enterprise API can escalate privileges by modifying user permissions, potentially gaining write access from a read-only role. This could allow unauthorized changes to resources and operations within the system. The system-admin role cannot be granted via this vulnerability, limiting the scope of privilege escalation.
Mitigation Recommendations
Upgrade Anchore Enterprise to version 5.27.2 or later, or 6.0.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated.
CVE-2026-63727: Incorrect Use of Privileged APIs in Anchore Anchore Enterprise
Description
Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to additional resources and operations. It is not possible to grant the system-admin role, but a read only user could be granted write access. This issue is fixed in Anchore Enterprise 5.27.2 and 6.0.1.
CVSS v4.0
Score 8.7high
Affected software
Anchore
Anchore Enterprise
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-63727 is an improper privilege escalation vulnerability in Anchore Enterprise's user management API affecting versions 5.11.0 to 5.27.1 and 6.0.0. An authenticated attacker with API access can issue calls that modify user permissions, elevating privileges from read-only to write access. The flaw does not allow granting the system-admin role. The issue is resolved in versions 5.27.2 and 6.0.1.
Potential Impact
An authenticated attacker with access to the Anchore Enterprise API can escalate privileges by modifying user permissions, potentially gaining write access from a read-only role. This could allow unauthorized changes to resources and operations within the system. The system-admin role cannot be granted via this vulnerability, limiting the scope of privilege escalation.
Mitigation Recommendations
Upgrade Anchore Enterprise to version 5.27.2 or later, or 6.0.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-17T21:21:58.625Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a68beba9c2644c7f8c13fba
Added to database: 07/28/2026, 14:37:46 UTC
Last enriched: 08/15/2026, 13:47:53 UTC
Last updated: 09/11/2026, 07:31:54 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.