CVE-2026-120430 in Camaleon CMS
Summary
by MITRE • 11/02/2026
Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The identified vulnerability represents a classic Insecure Direct Object Reference, commonly categorized under CWE-639 in the Common Weakness Enumeration standard. This flaw resides within the Admin::CategoriesController of Camaleon CMS versions prior to 2.9.2 and stems from insufficient server-side validation when processing requests related to category management. The core technical failure lies in the application's logic, which accepts a post_type_id parameter that dictates authorization scope but fails to rigorously verify that the target resource ID corresponds exclusively to categories associated with that specific post type. Consequently, an authenticated user who possesses permissions for one distinct post type can manipulate this input to reference and modify category IDs belonging to entirely different or unauthorized post types. This bypasses the intended access control mechanisms because the system trusts the client-supplied identifiers without cross-referencing them against a strict mapping of valid resources for that specific authorization context.
From an operational perspective, this vulnerability allows authenticated attackers to perform unauthorized modifications on critical site structures. By sending crafted update or destroy HTTP requests, an attacker can rename categories they do not own or delete essential categorization data entirely. This capability undermines the integrity and availability of content organization within the CMS platform. The impact extends beyond simple cosmetic changes; deleting categories can disrupt existing content associations, potentially leading to broken links or loss of metadata for published articles if those articles were linked to the deleted category. Furthermore, renaming unauthorized categories could be used to confuse site administrators or mask malicious activities by altering labels in a way that misleads other users about the nature or ownership of specific content segments.
This type of vulnerability aligns with several tactics and techniques within the MITRE ATT&CK framework, particularly those related to privilege escalation and resource manipulation. While it does not directly escalate privileges from unauthenticated to authenticated access, it allows an attacker to abuse their existing lower-level permissions to affect higher-impact resources outside their designated scope. This is often classified under lateral movement or impact techniques where the adversary modifies system configuration or data integrity. The lack of proper object level authorization checks means that the principle of least privilege is violated, as users are granted more control over objects than strictly necessary for their assigned role.
To mitigate this vulnerability, developers must implement strict server-side validation logic within the Admin::CategoriesController. This involves ensuring that every request to modify or delete a category explicitly verifies that the requested category ID belongs to the post_type_id provided in the request and is owned by or accessible to the currently authenticated user. Implementing robust access control checks at the model level, rather than relying solely on controller-level filters, can prevent such bypasses. Additionally, adopting an indirect reference map where internal identifiers are replaced with opaque, non-sequential tokens for public-facing operations can reduce the risk of ID enumeration and manipulation. Upgrading to Camaleon CMS version 2.9.2 or later is essential as it contains the necessary patches to enforce these security controls properly. Regular code reviews focusing on authorization logic and automated testing that includes negative test cases for cross-resource access are recommended practices to prevent similar issues in future development cycles.