CamaleonCMS CVE-2026-56721

Exploitation requires a valid authenticated session for any low-privileged CamaleonCMS user account - the attacker must be able to log in to the admin panel at /admin. No special configuration, non-default feature, or specific platform version beyond CamaleonCMS 2.9.2 or earlier is required; the updated_ajax endpoint is present and reachable in all affected versions by default. The parameter confusion is triggered by supplying the attacker's own user ID as the query-string id parameter while placing the victim's user ID in the URL path segment (routed to params[:user_id]), both of which are accessible in a single PATCH request. Exploitation is strictly limited to users who hold a valid site account; unauthenticated visitors cannot reach the admin panel endpoints and cannot exploit this flaw.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately represents the threat: network-exploitable with low complexity, requiring only a valid low-privileged account and no user interaction. The highest-impact path - overwriting an administrator password - requires no non-default configuration, no special feature flag, and no environmental precondition beyond possessing any site account. The attack mechanism is mechanically simple and fully documented by the PR's test suite, which provides a working proof-of-concept at the code level; however, no standalone public exploit tool has been identified and this CVE is not listed in the CISA KEV catalog, so real-world exploitation frequency is unknown. No EPSS data was provided, precluding probabilistic comparison. The practical risk is elevated beyond the CVSS score alone suggests because the attack is low-friction and the impact is immediate full administrative control. Defenders should not deprioritize this on the basis of no confirmed in-the-wild activity given the trivial exploitation path.

A low-privileged registered user on a CamaleonCMS site issues a crafted PATCH request to /admin/users/{admin_victim_id}/updated_ajax?id={attacker_own_id} with a new password in the request body. The authorization filter reads params[:id] (the attacker's own ID) and passes the self-edit check, while the action body loads the admin account from the URL path segment, overwriting the administrator's password. The attacker then authenticates to the admin panel with the new credentials and holds full administrative control of the site.