Description
Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.
Published: 2026-11-02
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized modification of categories (IDOR)
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an insecure direct object reference within the Admin::CategoriesController of Camaleon CMS. By supplying arbitrary category IDs in update or destroy requests, an authenticated user can rename or delete categories that they are not authorized to control. This enables an unauthorized modification of data, compromising the integrity of the CMS content.

Affected Systems

Owen2345 Camaleon CMS installations running any version earlier than 2.9.2 are affected. Versions 2.9.1 and older lack the protection that was added in the 2.9.2 release.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity with an impact on confidentiality and integrity. Exploitation requires only authentication within the CMS and does not require elevated privileges beyond user-level access. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. Attackers likely need to log into the CMS using any valid user account and then craft update or destroy requests referencing other category IDs to perform the unauthorized actions. Given the lack of remote code execution, the risk is primarily data integrity and potential indirect impact on compliance.

Generated by OpenCVE AI on November 2, 2026 at 15:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Camaleon CMS 2.9.2 or later.
  • Restrict category modification permissions for non-administrative users.
  • Validate that the category ID in update or delete requests is owned by the requesting user before performing the action.

Generated by OpenCVE AI on November 2, 2026 at 15:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Owen2345
Owen2345 camaleon Cms
Vendors & Products Owen2345
Owen2345 camaleon Cms

Mon, 02 Nov 2026 14:30:00 +0000

Type Values Removed Values Added
Description Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.
Title Camaleon CMS before 2.9.2 IDOR via Admin::CategoriesController
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Owen2345 Camaleon Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-02T14:28:55.035Z

Reserved: 2026-11-02T12:42:11.936Z

Link: CVE-2026-120430

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-02T15:17:24.387

Modified: 2026-11-02T15:17:24.527

Link: CVE-2026-120430

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T16:15:06Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key