Camaleon CMS CVE-2026-67616

Exploitation requires a valid authenticated session for any low-privileged user account registered within the Camaleon CMS instance (consistent with CVSS PR:L). The vulnerable surface is the admin drafts controller endpoint (/admin/post_types/:post_type_id/posts/drafts), which is network-accessible but gated behind session authentication - unauthenticated attackers cannot exploit this flaw. No special configuration, feature flag, elevated role, or non-default deployment mode is required; any authenticated user regardless of assigned role can trigger the missing authorization path. Exploitation is limited by the requirement for a valid session credential, the absence of a confidentiality or availability impact (no data read or service disruption is possible), and the scope boundary of the CMS application itself - the attacker cannot escalate to OS-level access or affect other applications. The post type scoping bypass additionally requires knowledge of a valid post_type_id and, for the ownership-theft path, a valid post_parent ID belonging to another user's draft.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) indicates the endpoint is network-accessible, requires no attack complexity or special attack requirements, and can be exploited by any authenticated low-privileged user without user interaction. The impact is confined to integrity (VI:L), with no confidentiality or availability dimension. There is no CISA KEV listing and no public proof-of-concept identified in the provided intelligence, suggesting this has not been actively weaponized at scale. The realistic risk is centered on administrative workflow disruption - low-privileged users can inject unauthorized draft entries into the admin review queue and overwrite in-progress content created by other authors. The secondary ownership-theft vector is notable in multi-author editorial environments but does not escalate to remote code execution, data exfiltration, or privilege escalation to admin. EPSS data was not provided, preventing a quantitative exploitation-probability comparison. Overall, this represents a moderate integrity concern for multi-tenant or multi-author CMS deployments, not a high-priority emergency - but organizations where content integrity and editorial attribution are sensitive (news, publishing, regulated content) should treat it with higher urgency.

An authenticated contributor or low-privileged subscriber with a valid CMS session sends a crafted POST request directly to /admin/post_types/:post_type_id/posts/drafts with session cookies, supplying arbitrary post data in the request body. Because the DraftsController performs no authorize! check, the server creates a draft under the targeted post type and populates the administrative drafts queue, forcing editors or admins to review and dismiss the unauthorized content. By supplying a known post_parent ID belonging to another user's in-progress post, the attacker can additionally overwrite that draft and redirect authorship attribution to themselves.