CVE-2026-19975
Received Received - Intake

Time-of-Check Time-of-Use in Azuriom CMS

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-check time-of-use. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. Upgrading to version 1.2.13 is capable of addressing this issue. Patch name: ae5596a9548e010a8a79838806eff60ef9554539. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19975
EUVD
EUVD-2026-60035

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
azuriom azuriom to 1.2.12 (inc)
azuriom azuriom 1.2.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a time-of-check time-of-use (TOCTOU) weakness in Azuriom CMS versions up to 1.2.12. It exists in the transferMoney function of the ProfileController.php file, where a race condition may allow unauthorized money transfers. The attack requires a high level of complexity and is exploitable remotely but with difficulty.

Detection Guidance

This vulnerability is a time-of-check time-of-use (TOCTOU) issue in Azuriom CMS up to 1.2.12, specifically in the money transfer function. Detection requires checking the version of Azuriom installed on your system. If you are running a version prior to 1.2.13, your system is vulnerable. You can check the version by examining the composer.json file or running commands like 'composer show azuriom/azuriom' if installed via Composer.

Impact Analysis

An attacker could exploit this to perform unauthorized money transfers, potentially leading to financial loss or account manipulation. The impact is limited due to the high complexity required for exploitation and the need for specific conditions.

Compliance Impact

The vulnerability involves a time-of-check time-of-use weakness in the money transfer function of Azuriom CMS, which could allow unauthorized financial transactions. This may impact compliance with GDPR if personal data is involved in the transaction process, as unauthorized access could violate data integrity principles. For HIPAA, if the system handles protected health information during transfers, the lack of atomicity in transactions could compromise data integrity, a key requirement.

Mitigation Strategies

Immediately upgrade Azuriom CMS to version 1.2.13 or later. This version includes a patch for the TOCTOU vulnerability in the money transfer function. Follow the official upgrade instructions provided by Azuriom to ensure a smooth transition. The patch is identified by the commit hash ae5596a9548e010a8a79838806eff60ef9554539.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19975. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart