CVE-2026-63727
Anchore Enterprise Privilege Escalation via User Management API
- State
- Published
- Severity
- 8.7 High
- Published
- Jul 28, 2026
- Updated
- Aug 14, 2026
- Reserved
- Jul 17, 2026
Description
Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to additional resources and operations. It is not possible to grant the system-admin role, but a read only user could be granted write access. This issue is fixed in Anchore Enterprise 5.27.2 and 6.0.1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-648 Incorrect Use of Privileged APIs
Affected Products
| Product | Versions |
|---|---|
Anchore EnterpriseAnchore |
|
References
- Release Notesrelease-notes
- https://www.vulncheck.com/advisories/anchore-enterprise-privilege-escalation-via-user-management-apithird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.