Camaleon CMS CVE-2026-120430

Requires an authenticated Camaleon CMS user who holds category-management permission for at least one post type (role meta such as _post_type_<id> => {'categories' => 1}); the attacker then supplies their own authorized post_type_id in the route while referencing a category ID owned by a different post type. Exploitation is limited by this authentication/authorization prerequisite (PR:L - a low-privilege but non-anonymous account is needed), affects only Camaleon CMS versions before 2.9.2, and impact is confined to renaming or deleting category objects within the same site; it does not grant data disclosure or code execution. The flaw stems from Admin::CategoriesController resolving the category via a global ID lookup rather than scoping it to the authorized post type.

This is a medium-severity (CVSS 4.0 base 5.3) authorization flaw whose real-world risk is moderate and bounded. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) confirms network reach and low attack complexity but requires an already-authenticated low-privilege user (PR:L), and impact is limited to integrity (category rename) and availability (category deletion) with no confidentiality exposure (VC:N). The vendor-assigned CWE-639 and the patch diff confirm this is an IDOR/broken-object-authorization issue, not a pre-auth compromise - the attacker must already hold category-management rights for at least one post type. No EPSS score is provided in the input, so probability-of-exploitation cannot be quantified. The vulnerability is NOT on the CISA KEV list and there is no confirmed standalone public exploit; however, the merged fix PR #1148 ships a regression test that discloses the exact malicious request pattern, lowering the bar to reproduce it. The vuln.today priority of 'this_month' aligns with these signals: a genuine authorization bug worth patching on a normal monthly cadence rather than an emergency. Note one tension for triage: the 'Authentication Bypass' tag is imprecise - this is an authorization/IDOR issue affecting already-authenticated users, not an authentication bypass.

An attacker holds a valid Camaleon CMS account with category-management permission for one post type (e.g., a contributor role). They send a PATCH or DELETE request to /admin/post_type/<their_authorized_post_type_id>/categories/<arbitrary_category_id>, pairing their authorized post_type_id with a category ID belonging to a different post type, to rename or delete categories they were never granted access to. No standalone weaponized exploit is published, but the regression test in fix PR #1148 demonstrates the precise request needed to trigger it.