EUVD-2026-56232
GHSA-x628-p4h4-vf39
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable requiring only an authenticated low-privilege session (PR:L); impact is limited to partial confidentiality disclosure of profile data with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators, due to the profile action being excluded from the role validation filter with no compensating ownership check.
AnalysisAI
Insecure Direct Object Reference in CamaleonCMS 2.9.2 and earlier allows any authenticated user to enumerate and read profile data belonging to any other user, including administrators. The Admin::UsersController#profile action was explicitly excluded from the validate_role authorization filter with no compensating ownership check, meaning a low-privilege 'client' role account can supply an arbitrary integer user_id query parameter to GET /admin/profile and receive the target user's email, username, role, and custom field data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session in the CamaleonCMS admin panel - any user role capable of logging into /admin is sufficient, including the lowest-privilege 'client' role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) correctly characterizes this as a low-complexity, network-exploitable flaw requiring only a valid authenticated session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privilege CamaleonCMS account - such as a 'client' role created for content submission - authenticates to the admin panel and sends a scripted series of GET requests to /admin/profile?user_id=1, ?user_id=2, and so on, iterating over the sequential integer ID space. Each response returns the target user's profile data, allowing the attacker to identify administrator accounts, harvest their email addresses and usernames, and use that data for targeted phishing or credential-stuffing against external services. … |
| Remediation | Upstream fix is available via commit ae10da7cfce902a8552927c57b0a562fb1676040 and PR #1197 at https://github.com/owen2345/camaleon-cms/pull/1197; a specific patched gem release version is not confirmed in available data, so administrators should monitor the repository for a tagged release or apply the patch from the referenced commit directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Camaleoncms
View allStored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist a
Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a m
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administ
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote cod
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag,
Authenticated SQL injection in CamaleonCMS 2.9.1 allows low-privileged users holding post creation or editing rights to
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today