CVE-2026-120430

Camaleon CMS before 2.9.2 IDOR via Admin::CategoriesController

Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Owen2345

Products

Camaleon Cms

CVE-2026-120429

Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Owen2345

Products

Camaleon Cms

CVE-2026-116009

Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action

Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-102261

owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization

A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Owen2345

Products

Camaleon Cms

CVE-2026-86100

Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-73331

CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field

CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers can supply malicious slug payloads using boolean- or union-style blind SQL injection techniques to extract sensitive data from the underlying SQLite database, including administrative credentials and configuration values stored in application tables.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-73332

CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field

CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edit endpoint, which lacks proper authorization controls. Attackers can persist malicious script payloads into the database that execute in victims' browsers when the contact form loads, enabling cookie theft, forged authenticated requests against the admin interface, and session takeover of viewing users.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-73330

CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-73329

CamaleonCMS Stored XSS via Draft Post Title Creation Endpoint

CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a malicious HTML payload as a draft title through the drafts creation endpoint, which is persisted to the database without escaping and later rendered as raw HTML in the admin drafts listing, enabling administrator session compromise, cookie theft, and forged authenticated requests.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-73326

CamaleonCMS Missing Authorization via Plugin Administration Endpoints

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration parameters at runtime across the attack, front_cache, cama_meta_tag, and cama_contact_form plugins to alter cached page behavior, modify public meta-tag output, or reconfigure contact forms, enabling account takeover when chained with stored cross-site scripting through the contact form's before_html field.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-67616

Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only session authentication to create unauthorized drafts that appear in the administrative drafts queue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-66748

Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_eval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-56721

CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action body in the UsersController. Attackers can send a PATCH request to the updated_ajax endpoint setting params[:id] to their own user ID to pass the self-authorization check while simultaneously setting params[:user_id] to a victim's ID, causing the controller to load and mutate the victim's account, including overwriting administrator passwords to achieve full site takeover.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-56720

CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators, due to the profile action being excluded from the role validation filter with no compensating ownership check.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-1776

Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read

Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms