CVE-2026-88959 describes a missing role-based access control enforcement in Anchor CMS through version 0.12.7. Authenticated users with low privileges can exploit this by sending POST requests to admin/users/add or admin/users/edit endpoints to escalate their privileges to administrator level. This vulnerability allows unauthorized creation or modification of administrator accounts, compromising the integrity and control of the CMS.

Successful exploitation grants attackers full administrative access to Anchor CMS, enabling them to control the system, modify content, manage users, and potentially execute further attacks. The vulnerability affects confidentiality, integrity, and availability of the CMS environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the admin user-management endpoints to trusted users only and monitor for suspicious activity involving user account modifications.