Back to overview

CVE-2026-63727

HIGH
8.8
CVSS 3.1
Description
Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to additional resources and operations. It is not possible to grant the system-admin role, but a read only user could be granted write access. This issue is fixed in Anchore Enterprise 5.27.2 and 6.0.1.

Metadata

CVE ID
CVE-2026-63727
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-07-17 21:21 UTC
Published
2026-07-28 14:25 UTC
Last updated
2026-07-28 14:38 UTC
Primary CWE
CWE-648
Incorrect Use of Privileged APIs
Vendor / Product
Anchore / Anchore Enterprise
Sources
cve.org  ·  NVD

Severity & Metrics

8.8 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Anchore Anchore Enterprise — 5.11.0 < 5.27.2, 6.0.0 < 6.0.1
Weakness (CWE)
CWESourceDescription
CWE-648 cna Incorrect Use of Privileged APIs
CVSS scores (2)
ScoreSeverityVersionSourceVector
8.8 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (2)
Back to overview