CamaleonCMS CVE-2026-56720

Exploitation requires a valid authenticated session in the CamaleonCMS admin panel - any user role capable of logging into /admin is sufficient, including the lowest-privilege 'client' role. The attacker must supply an arbitrary integer value as the user_id query parameter in a GET request to /admin/profile. No special server configuration, non-default feature flag, or plugin is required; the authorization gap exists in the default controller code shipped with the gem. Exploitation is bounded by the requirement for a pre-existing authenticated session - anonymous or unauthenticated access to the admin panel is not sufficient. Additionally, only profile data (email, username, role, custom fields) is disclosed; the flaw grants no write access, privilege escalation, or session control over other users.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) correctly characterizes this as a low-complexity, network-exploitable flaw requiring only a valid authenticated session. The confidentiality impact is bounded - profile data including email, username, and role is disclosed, but no write access or session hijacking is enabled. No EPSS data was supplied, and neither a CISA KEV listing nor a public POC is confirmed in the available intelligence; exploitation status is inferred as no public exploit based on absence of those signals from the VulnCheck report. Real-world risk hinges on who holds low-privilege accounts: even a mid-sized municipal IT team in boleslawiec running CamaleonCMS for a departmental site would face meaningful downstream phishing risk if attackers could silently harvest administrator email addresses and role assignments through this endpoint. The 5.3 CVSS score is appropriate - the limited confidentiality scope and authenticated prerequisite keep this from being a critical finding, but the trivial exploitability (no specialized tooling required) means it should be patched promptly rather than deferred.

An attacker with a low-privilege CamaleonCMS account - such as a 'client' role created for content submission - authenticates to the admin panel and sends a scripted series of GET requests to /admin/profile?user_id=1, ?user_id=2, and so on, iterating over the sequential integer ID space. Each response returns the target user's profile data, allowing the attacker to identify administrator accounts, harvest their email addresses and usernames, and use that data for targeted phishing or credential-stuffing against external services. No exploit code is confirmed publicly available, but the technique requires only curl or a browser and no specialized knowledge.