CamaleonCMS CVE-2026-73326

Exploitation requires possession of at minimum one low-privileged authenticated account on the target CamaleonCMS instance - there is no unauthenticated path; the CVSS 4.0 PR:L metric confirms this. The four vulnerable plugin-administration endpoints (attack, front_cache, cama_meta_tag, and cama_contact_form) must be accessible, meaning those plugins must be installed and active. The highest-impact outcome - account takeover - additionally requires that an administrator navigates to the compromised plugin configuration page after payload injection, introducing an administrator user-interaction dependency that limits the scenario to cases where admin activity on plugin settings is routine. Exploitation is blocked entirely if no low-privileged accounts exist (e.g., registration is closed and no internal accounts have been provisioned) or if the affected plugins are disabled.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) reflects low-complexity, network-accessible exploitation requiring only a low-privileged account with no user interaction needed to reach the vulnerable endpoints themselves - a realistic and low-barrier attack profile. The high vulnerable-system integrity impact (VI:H) captures the direct consequence of unrestricted plugin configuration modification, while low confidentiality (VC:L) and availability (VA:L) scores moderate the base rating to 7.2. The absence of subsequent-system impact metrics (SC:N/SI:N/SA:N) in the provided vector is notable - the account takeover chain via stored XSS does propagate impact to the administrator's browser session, suggesting the provided vector may understate downstream consequence. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, so exploitation is currently theoretical; even a mid-sized municipal IT team in sopot should treat this as urgent, however, because the attack chain - low-privilege account to admin takeover - requires no vulnerability chaining beyond a single content injection and a routine admin page visit. The chaining requirement (broken access control followed by stored XSS followed by admin interaction) introduces modest real-world friction compared to a direct remote code execution, but each individual step is elementary.

An attacker with any valid CamaleonCMS account sends a crafted HTTP POST request directly to the unprotected cama_contact_form plugin-administration endpoint, injecting a JavaScript keylogger or session-stealing payload into the before_html configuration field. When a site administrator subsequently navigates to the contact form settings page, the stored script executes in their privileged browser session, exfiltrating the session cookie to the attacker's server. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP tooling and knowledge of the endpoint paths disclosed in the researcher's blog post.