EUVD-2026-57416
GHSA-x74h-897c-r345
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for required low-privilege account; UI:R and S:C because account takeover chain requires admin to visit injected page, crossing scope boundary via stored XSS.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration parameters at runtime across the attack, front_cache, cama_meta_tag, and cama_contact_form plugins to alter cached page behavior, modify public meta-tag output, or reconfigure contact forms, enabling account takeover when chained with stored cross-site scripting through the contact form's before_html field.
AnalysisAI
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag, and cama_contact_form - to any authenticated low-privileged user, entirely bypassing administrator-level access controls. An attacker holding a standard account can modify live plugin configurations, including injecting arbitrary HTML into the contact form's before_html field to plant a persistent XSS payload. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of at minimum one low-privileged authenticated account on the target CamaleonCMS instance - there is no unauthenticated path; the CVSS 4.0 PR:L metric confirms this. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) reflects low-complexity, network-accessible exploitation requiring only a low-privileged account with no user interaction needed to reach the vulnerable endpoints themselves - a realistic and low-barrier attack profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with any valid CamaleonCMS account sends a crafted HTTP POST request directly to the unprotected cama_contact_form plugin-administration endpoint, injecting a JavaScript keylogger or session-stealing payload into the before_html configuration field. When a site administrator subsequently navigates to the contact form settings page, the stored script executes in their privileged browser session, exfiltrating the session cookie to the attacker's server. … |
| Remediation | Apply the vendor-released patch from the CamaleonCMS GitHub repository at https://github.com/owen2345/camaleon-cms; the exact patched release tag is not specified in the available advisory data, so operators should inspect the repository's releases page and recent commits to identify the fix and verify the changelog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct inventory of all CamaleonCMS deployments and identify current versions; enable logging of the four affected endpoints (attack, front_cache, cama_meta_tag, cama_contact_form). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Camaleoncms
View allStored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist a
Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a m
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administ
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote cod
Authenticated SQL injection in CamaleonCMS 2.9.1 allows low-privileged users holding post creation or editing rights to
Insecure Direct Object Reference in CamaleonCMS 2.9.2 and earlier allows any authenticated user to enumerate and read pr
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today