The vulnerability stems from a missing authorization check in the Admin::MediaController of Camaleon CMS versions prior to 2.9.2. Low‑privileged authenticated users can reach endpoints that should be protected by role‑based Media permissions. They can POST to /admin/media/upload to store arbitrary files, retrieve private media through download_private_file, and alter other users’ avatars via crop and saved_avatar. This enables unauthorized data exfiltration, content tampering, and user impersonation.

Affected systems are installations of Camaleon CMS from vendor owen2345, specifically any release older than 2.9.2. The CVE references the 2.9.1 source code and the 2.9.2 release notes that include the fix. Administrators should verify that their deployment is running 2.9.2 or newer.

The CVSS score of 7.1 indicates high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers only need authenticated access with low privileges and can exploit the flaw directly from the web interface, so the risk is moderate to high if an attacker can log in. No special exploit code is required beyond standard web requests, suggesting a realistic threat for compromised sites with weak user base.