Unverified50% confidenceFactExact time
anchor-cms has a privilege escalation vulnerability in the edit user path, where the code forcibly sets $input['role'] to administrator, while the authorization filter only checks whether the session exists and does not check the role.
1
Sources
50%
Confidence
Long-term
Relevance
10/13/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedUsers can reduce cross-site behavioral data collection by reviewing privacy settings, paying attention to permission grants, monitoring official statements, using anti-tracking plugins, and clearing cookies.66% similarUnverifiedThe clipboard access prompt mechanism only targets active cross-app read behaviors and does not prevent clipboard managers that have been actively authorized by the user from silently recording in the background.66% similarUnverifiedWhen an Agent processes untrusted external inputs, the input content must be filtered, secondary confirmation must be set for critical operations, and the scope of accessible data and the types of callable operations must be strictly limited.64% similarUnverifiedWhen code only verifies that a user is logged in without verifying whether the user is authorized to invoke a specific tool, it is equivalent to exposing the entire toolset to any caller holding a valid token.62% similarUnverifiedThe local checker verifies whether the schema has required keys, whether cases contain input and expect, whether the host role is scratch or system-of-record, whether scratch is forbidden from storing user data, and whether scan_paths exist.62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1018409API
curl https://kongchang.com/api/v1/knowledge/claims/1018409MCP
get_claim(id=1018409)