The vulnerability is an improper authorization flaw in the administrator draft autosave endpoint of Camaleon CMS. An authenticated user with low privileges can specify any post_id when posting to /admin/post_type/<POST_TYPE_ID>/drafts, thereby overwriting the draft associated with another user's post. This can lead to unauthorized modification or loss of content owned by other users, compromising data integrity and potentially allowing defacement or sabotage of draft content.

Camaleon CMS version 2.9.2 on Linux, macOS, and Windows platforms is affected. The flaw exists in the draft autosave API endpoint and is accessible to users authenticated to the CMS administrator interface. All three operating systems supported by the CPE entries are impacted.

The CVSS score of 5.1 indicates medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited. An attacker must first authenticate as a low‑privileged user within the CMS; from there they can craft a POST request with an arbitrary post_id to overwrite another user's draft. The impact is limited to the affected content and does not provide further privileges or system access, but the ability to tamper with draft content poses a moderate risk to data integrity.