CamaleonCMS permits any authenticated low‑privileged user to access four unprotected plugin‑administration endpoints and modify settings for the attack_cache, front_cache, cama_meta_tag and cama_contact_form plugins. This missing authorization flaw allows the attacker to alter cached page behavior, change public meta‑tag output and reconfigure contact form fields. When combined with stored cross‑site scripting through the contact form’s before_html field, the attacker can achieve account takeover. The weakness is a classic example of missing authorization (CWE‑862).

The affected product is CamaleonCMS by owen2345. The CVE lists no specific version information, so any release that still contains the four unprotected endpoints is vulnerable. The flaw is present on the plugin‑administration URLs handling attack_cache, front_cache, cama_meta_tag and cama_contact_form configuration changes.

With a CVSS score of 7.2 the vulnerability is considered medium‑high severity. No EPSS score is available, indicating no known exploitation probability data. The flaw is not listed in CISA KEV. Attackers must be authenticated but do not need administrator privileges; they can simply send HTTP requests to the vulnerable endpoints to modify plugin settings, and can chain the XSS component to elevate privilege or compromise accounts.