EUVD-2026-115238
GHSA-w2c5-xppr-2hh6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitPOST directly to /admin/media endpoints
-
ExecutionBypass missing :manage,:media authorization
-
ImpactRead private media and overwrite other users' avatars
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated Camaleon CMS account whose role does NOT include the media manager (':manage, :media') permission; in versions before 2.9.2 the MediaController's upload, download_private_file, crop (with saved_avatar), and actions endpoints verified only that the user was logged in, not that they held the media permission, so they could be reached by direct URL/POST while only index and ajax enforced authorization. The limiting factors are that an account is required (PR:L, so not remote-unauthenticated) and that the fix in 2.9.2 now returns 403 Forbidden for users without the media permission; no special non-default configuration, user interaction, or platform condition is required beyond having an authenticated low-privilege role. |
| Impact | This is a credible but not emergency-grade priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw that requires an authenticated low-privileged account (PR:L), and the vuln.today Decision label is 'this_week' rather than act_now/emergency. No CISA KEV listing and no EPSS score are provided in the input, and the references contain only the patch PR, the patch commit, pre-patch source, the release tag, and the VulnCheck advisory - there is no PoC or exploit reference, so exploitation status is 'no public exploit identified at time of analysis.' The strongest signal is the confirmed source-code evidence: the pre-2.9.2 MediaController checked authentication but not the ':manage, :media' authorization on the upload, download_private_file, crop, and actions endpoints (CWE-862), which VulnCheck and the vendor both document. The main factor that bounds real-world risk is the PR:L requirement - an attacker needs a valid, if unprivileged, account - so this is an insider/low-trust-tenant privilege issue rather than a remote-unauthenticated breach. The listed impact (VC:H for reading private media, VI:L for storing files and changing other users' avatars, VA:N) is consistent with a confidentiality-weighted broken-access-control bug, not remote code execution. |
| Exploit ScenarioDerived | A low-privileged authenticated Camaleon CMS user whose role does not include the media manager permission sends crafted requests directly to the admin media endpoints, bypassing the UI restrictions that normally hide them. They POST to /admin/media/upload to store files, call download_private_file to read other users' private media, and invoke crop with saved_avatar to overwrite another user's avatar. No public exploit code is identified in the provided data, and the attack requires a valid account (PR:L) but low complexity (AC:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Camaleon CMS releases before 2.9.2 enforce only authentication, not authorization, on the Admin::MediaController endpoints that handle uploads, private file downloads, cropping and media actions, letting any logged-in user whose role lacks the media manager permission reach those functions by direct URL or POST. A low-privileged authenticated attacker can therefore store files via /admin/media/upload, read private media through download_private_file, and use crop with saved_avatar to alter other users' avatars, producing a high confidentiality impact with limited integrity impact. The vendor has released 2.9.2 with a centralized before_action check, so no public exploit code or active exploitation is indicated in the available data; the CVSS 4.0 base score is 7.1 and priority is this_week, reflecting a real but not emergency-grade issue given the authenticated-account prerequisite.
RemediationAI
Upgrade to Camaleon CMS 2.9.2, which is the vendor-released patch and adds a centralized before_action :verify_media_authorization requiring ':manage, :media' on every Admin::MediaController endpoint (see https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2, https://github.com/owen2345/camaleon-cms/pull/1147 and the vendor advisory https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.2-missing-authorization-via-admin-mediacontroller). Treat this as a breaking change: 2.9.2 documents the new behavior in docs/upgrading-to-2.9.2.md, and after upgrading, users whose roles lack the media manager permission will receive 403 Forbidden where they previously could reach media endpoints by direct URL, so backfill the media permission into any role that legitimately needs it before or during rollout to avoid workflow disruption. If an immediate upgrade is not possible, the compensating control is to constrain exposure of the /admin/media/* routes at the reverse proxy or router level so accounts without the media role cannot reach upload, download_private_file, crop and actions; the trade-off is that any such blocking is coarse-grained and must be maintained manually, and it does not fix the underlying missing authorization for users who do hold an admin session on a permitted path. Review existing media and avatar content, and any roles created before 2.9.2, for unauthorized changes made through these endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Camaleon CMS is a Ruby on Rails content management system that uses CanCanCan-style ability checks, expressed in the codebase as authorize! :manage, :media. The vulnerability is a classic CWE-862 Missing Authorization: the controller applied the media permission check only to the index and ajax actions (and in ajax only when media_action was not 'crop_url'), while upload, download_private_file, crop and actions relied solely on the inherited authentication filter from CamaleonCms::AdminController. Because Rails routes are reachable independently of the UI, a user without the media role could bypass the interface restrictions and invoke those actions directly. The upstream fix in pull request 1147 replaces the scattered checks with a single before_action :verify_media_authorization that calls authorize! :manage, :media for every endpoint in the controller, and the changelog labels this a breaking change because roles previously able to reach media endpoints by direct URL will now receive 403 Forbidden. The CPE cpe:2.3:a:owen2345:camaleon_cms:*:*:*:*:*:*:*:* covers all versions prior to the 2.9.2 release tag.
Know when Camaleon Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated low-priv account over the network with no user interaction (PR:L, AV:N, AC:L, UI:N); high confidentiality from reading private media, low integrity from storing files/changing avatars, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.
Executive ViewAI
Camaleon CMS versions before 2.9.2 improperly enforce only authentication, not authorization, on media management endpoints, allowing any logged-in user to upload files, access private media, and alter other users' avatars regardless of their assigned role. This directly affects the confidentiality of sensitive media and the integrity of user profiles, with potential for data leakage and unauthorized file storage. Leadership should prioritize remediation this week to close this authorization gap before it can be exploited by malicious insiders or compromised accounts.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Camaleon Cms
View allCamaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. Rated critical severity (CVSS 9
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats para
Authenticated remote code execution in Camaleon CMS 2.1.1 through 2.9.1 lets users who hold the custom_fields manage per
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. Rated high severity (CVSS 7.7),
Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the cont
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s p
Camaleon CMS releases before 2.9.3 let an authenticated user who holds only the 'media' permission escape the site's tem
In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attack
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. Rated medium severity (CVSS 6.1), this vulnerability
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS
Draft post creation in Camaleon CMS through 2.9.2 allows any authenticated low-privileged user to create and overwrite d
Category-management authorization bypass in Camaleon CMS before 2.9.2 lets an authenticated low-privileged user rename o
Exploit-DB