CamaleonCMS versions 2.9.2 and earlier have a parameter confusion flaw that allows an authenticated low‑privileged user to hijack any account. By sending a PATCH request to the updated_ajax endpoint, a malicious actor can set params[:id] to their own user id to satisfy the self‑authorization filter while simultaneously setting params[:user_id] to a victim's id, causing the controller to load and mutate the victim's account. This flaw permits overwriting administrator passwords and other credential data, enabling full site takeover.

The affected system is CamaleonCMS maintained by owen2345, with all releases up to and including version 2.9.2 subject to the IDOR bug. No specific sub‑versions beyond 2.9.2 are listed as affected.

The CVSS score of 8.7 categorizes this as high severity. However, the EPSS score of less than 1 % indicates that exploitation is currently unlikely to be seen in the wild, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack scenario requires a legitimate user session; an attacker must first authenticate with the site, then craft the conflicting PATCH request. If successful, the attacker gains administrative level access and can alter any user credentials, fully compromising the CMS instance.