Camaleon CMS EUVD-2026-88630

Requires an authenticated Camaleon CMS session possessing the :manage, :media permission (media library access) but lacking :manage, :users; the attacker invokes the admin media crop endpoint (app/controllers/camaleon_cms/admin/media_controller.rb#crop) with the saved_avatar parameter set to a user ID other than their own. Exploitation is limited by this authentication/permission prerequisite (not unauthenticated) and by scope: post-PR-#1267 the target is already scoped to current_site.users, so the bypass reaches only same-site, cross-user avatar writes, not cross-tenant. Impact is confined to overwriting another user's avatar/profile meta - no password, credential, or confidential data access.

This is a genuine but low-severity object-level authorization bypass (CWE-639 / IDOR), and the signals are internally consistent rather than conflicting. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L, score 5.3) tells the real story: network-reachable and low-complexity, but requiring an existing authenticated session (PR:L) and yielding no confidentiality impact (VC:N) - only low integrity and availability effects limited to another user's avatar/profile meta. The E:P flag plus the description ('The exploit has been published') confirm publicly available exploit code exists, but this is NOT the same as active exploitation: there is no CISA KEV listing and no EPSS score provided, so there is no evidence of in-the-wild use. The source-code diff strongly corroborates the mechanism - the fix adds an authorize! :manage, :users gate on non-self saved_avatar targets in MediaController#crop, confirming a media-permission holder could previously write another user's avatar through the crop side-door. Net: a real, patch-worthy authorization flaw, but its impact ceiling is modest (profile-meta tampering, not account takeover or data theft), so it warrants routine patching rather than emergency response.

An authenticated user holding only the :manage, :media permission (e.g., a content editor) sends a crop request to the media controller with saved_avatar set to another user's ID. Because the pre-patch endpoint gated only on media permission and never performed a per-target authorization check, the attacker overwrites the victim's avatar without the :manage, :users capability. Published exploit code exists (E:P), lowering the barrier, though a valid low-privilege session is still required.