CVE-2026-120429 in Camaleon CMS
Summary
by MITRE • 11/02/2026
Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in Camaleon CMS versions prior to 2.9.2 represents a critical failure in access control mechanisms within the administrative interface. Specifically, the flaw resides in the Admin::MediaController class, which is responsible for handling media-related operations such as file uploads, downloads, and image processing. The core issue stems from missing authorization checks that fail to properly validate whether an authenticated user possesses the necessary role-based permissions to execute these actions. In a secure implementation of role-based access control, any request directed at administrative endpoints must be rigorously verified against the user's assigned privileges before execution. However, in this instance, the system allows low-privileged authenticated users to bypass these restrictions entirely. This means that individuals with minimal or standard user roles can perform operations intended exclusively for administrators or media managers, fundamentally undermining the security model of the content management system.
The operational impact of this vulnerability is multifaceted and severe, affecting both data confidentiality and integrity. Attackers who have obtained valid credentials for a low-privileged account can exploit several specific endpoints to achieve malicious objectives. By sending POST requests to /admin/media/upload, an attacker can upload arbitrary files to the server's media storage directory. This capability alone poses significant risks, including potential remote code execution if the uploaded file is subsequently executed by the web server or application logic. Furthermore, the vulnerability extends to data exfiltration through the download_private_file endpoint. Normally, private media should be restricted to authorized personnel only, but this flaw allows attackers to retrieve sensitive files that are not meant for public consumption. This breach of confidentiality can lead to the exposure of proprietary documents, user personal information, or other confidential assets stored within the CMS environment.
In addition to file manipulation and data theft, the vulnerability enables unauthorized modification of user profiles through image processing functions. Specifically, attackers can utilize the crop functionality combined with saved_avatar parameters to alter the avatar images associated with other users' accounts. While this may appear less critical than code execution or data leakage, it constitutes a violation of integrity and privacy standards. It allows an attacker to deface another user's profile, potentially facilitating social engineering attacks or reputational damage within the organization using the CMS. This aspect of the vulnerability highlights how seemingly minor administrative functions can be weaponized when proper authorization checks are absent, allowing low-privileged users to interfere with other users' data and settings without detection or permission.
From a classification perspective, this issue aligns directly with CWE-285, which describes Improper Authorization, where an actor is able to access resources or perform actions for which they should not have been granted permissions. The exploitation technique maps closely to MITRE ATT&CK techniques related to Privilege Escalation and Collection via Client Side Techniques, as the attacker leverages legitimate but misconfigured application features to gain unauthorized capabilities. To mitigate this vulnerability, organizations running Camaleon CMS must immediately upgrade to version 2.9.2 or later, where these authorization checks have been corrected. Until an update is applied, administrators should implement strict network-level access controls to restrict entry to the /admin/media endpoints only from trusted IP addresses and ensure that all administrative interfaces are protected by multi-factor authentication to reduce the risk of credential compromise leading to exploitation.