EUVD-2026-52486
GHSA-hwrq-jcj5-6vc6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requiring only a valid low-privileged authenticated session (PR:L); integrity impact is limited to unauthorized draft creation with no confidentiality or availability effect and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only session authentication to create unauthorized drafts that appear in the administrative drafts queue.
AnalysisAI
Draft post creation in Camaleon CMS through 2.9.2 allows any authenticated low-privileged user to create and overwrite draft posts by bypassing role and permission checks on the admin drafts endpoint. The DraftsController's overridden create and update actions omitted the authorize! calls enforced by the parent PostsController, and used global unscoped post lookups that ignore post type and user ownership, enabling cross-post-type draft manipulation and ownership attribution changes on existing drafts. No CISA KEV listing or public exploit code has been identified; the CVSS 4.0 score of 5.3 (PR:L, VI:L) reflects limited integrity impact with no confidentiality or availability consequence.
Technical ContextAI
Camaleon CMS is a Ruby on Rails-based content management system (CPE: cpe:2.3:a:owen2345:camaleon-cms:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization). The DraftsController inherits from PostsController, which applies authorize! before every mutating action via a before-action chain. When DraftsController overrode create and update to handle autosave logic, it broke that authorization chain - neither action called authorize!. Compounding this, draft lookups used global ActiveRecord scopes (CamaleonCms::Post.drafts.where(...) and CamaleonCms::Post.drafts.find(...)) rather than being scoped to @post_type, allowing a user with access to one post type to reach drafts in another. The set_post_data_params before-action also unconditionally set user_id to the current user on both new and existing records, enabling ownership theft when a low-privileged user overwrote a draft authored by someone else. The fix in commit 88ab703 (PR #1196) scopes all lookups to @post_type.posts.drafts, adds authorize! :update on existing-draft mutations and authorize! :create_post on new-draft creation, restricts user_id assignment to genuinely new records only, and validates post_parent against a real post within the current site.
RemediationAI
Apply the upstream fix by updating to a revision at or after commit 88ab703 (https://github.com/owen2345/camaleon-cms/commit/88ab703b5ac041afb93a9993470aa366093c5311) from the GitHub repository at https://github.com/owen2345/camaleon-cms/pull/1196. No formally tagged patched release version is confirmed in the available data - administrators should monitor the repository for a tagged release and update their Gemfile lock accordingly once published. As a compensating control for deployments that cannot patch immediately, restrict CMS account provisioning so that only users who legitimately require draft creation are granted authenticated sessions, reducing the pool of potential abusers; note this does not eliminate the vulnerability for any authenticated user. Enable audit logging on admin queue activity and alert on draft creation events attributed to accounts below editor-level roles as a detection measure. There are no known workarounds that disable the drafts endpoint without impacting legitimate autosave functionality.
More in Camaleon Cms
View allCamaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. Rated critical severity (CVSS 9
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats para
We need to produce a JSON object with the specified fields. All fields are plain text strings. The input includes CVE-20
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. Rated high severity (CVSS 7.7),
Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the cont
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s p
In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attack
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. Rated medium severity (CVSS 6.1), this vulnerability
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS
Improper authorization in Camaleon CMS 2.9.2 allows any low-privileged authenticated user to overwrite draft content bel
In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload fea
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. Rated medium severity (CVSS 4.3), this
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today