Camaleon CMS versions up to 2.9.2 contain a missing authorization check on the /admin/post_type drafts endpoint. Authenticated users with low privileges can issue requests to this endpoint and create draft posts, which then appear in the administrative drafts queue. This flaw does not grant code execution or direct access to sensitive data, but it enables abuse of the CMS content creation workflow and could be leveraged to plant hidden posts or gather information about the site’s content pipeline.

All installations of Camaleon CMS at or below version 2.9.2 are affected. The vulnerability was fixed in commit 88ab703b5ac041afb93a9993470aa366093c5311, which resolves the authorization bypass on the drafts endpoint.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to be logged in with a low‑privileged account and must send requests to the drafts endpoint, typically over a web interface accessible via HTTP or HTTPS. The lack of an explicit authorization check allows them to bypass role checks, making the exploit straightforward for authenticated users.