Camaleon CMS CVE-2026-10715

Exploitation requires a valid low-privileged account with access to the Camaleon CMS admin interface (PR:L per CVSS 4.0 vector). The attacker must know or successfully enumerate a valid post_id belonging to another user's draft, which is feasible given that CMS post IDs are typically sequential integers. The UI:P indicator in the provided CVSS 4.0 vector implies some passive user interaction may be involved (e.g., the victim must have saved a draft that the attacker can target), though the precise interaction is not described in the advisory. Exploitation does NOT grant elevated privileges, code execution, access to credentials, or any availability impact. Exploitation is bounded to the integrity of draft content within the application and is not possible by unauthenticated users or users without admin-area access.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects a constrained impact: AV:N and AC:L indicate the endpoint is network-reachable without complexity, but PR:L confirms a valid account is required, meaningfully limiting the attacker pool to existing authenticated users. The impact is confined to low integrity degradation on the vulnerable system (VI:L) with no confidentiality or availability effects. No EPSS data was provided, so exploitation probability cannot be quantified numerically; however, the absence from CISA KEV and the lack of any identified POC together suggest no current widespread exploitation. The real-world business risk is concentrated in multi-author editorial deployments where silent draft corruption could disrupt publishing workflows or introduce unauthorized content changes prior to publication. This is not a high-urgency patching priority for most organizations, but it warrants attention in any deployment with untrusted low-privileged users.

An authenticated contributor enumerates post_id integer values by observing their own draft save requests and then increments or decrements the value to target another user's unpublished post. A crafted POST request to /admin/post_type/<POST_TYPE_ID>/drafts with the victim's post_id overwrites their draft with attacker-controlled content without any notification to the victim. The attack requires no special tooling beyond a standard HTTP client and a valid low-privileged session token.