CVE-2026-56720 in CamaleonCMS
Summary
by MITRE • 08/11/2026
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators, due to the profile action being excluded from the role validation filter with no compensating ownership check.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within CamaleonCMS versions 2.9.2 and earlier where a critical authorization flaw has been identified in the admin users controller component. The flaw stems from improper access control implementation that fails to validate user permissions when processing profile requests, creating an arbitrary user data disclosure scenario. The vulnerability specifically affects the profile action within the admin users controller which is deliberately excluded from the standard role validation filter mechanism. This exclusion occurs without implementing compensating ownership checks or alternative authorization mechanisms, leaving the system vulnerable to unauthorized data access.
The technical exploitation of this vulnerability relies on the predictable nature of user ID assignment within the application's database structure. Authenticated users can leverage this flaw by crafting GET requests to the admin profile endpoint and supplying sequential integer values as user ID parameters. This enumeration technique allows attackers to systematically retrieve profile information for any user account within the system, including high-privilege administrator accounts that may contain sensitive credentials, configuration details, or other confidential data. The vulnerability demonstrates a clear violation of the principle of least privilege, where access controls are bypassed through simple parameter manipulation without requiring additional authentication factors.
The operational impact of this vulnerability is significant as it enables unauthorized information disclosure attacks that can compromise the entire administrative ecosystem of the CMS platform. Attackers can harvest user profile information including usernames, email addresses, role assignments, and potentially sensitive metadata that could be used for further attacks such as credential stuffing, social engineering campaigns, or privilege escalation attempts. The vulnerability affects all authenticated users within the system regardless of their initial permission level, creating a widespread security risk that undermines the fundamental security model of the application. This flaw directly violates security standards such as those outlined in CWE-285 which addresses improper authorization issues, and aligns with ATT&CK techniques categorized under privilege escalation and credential access.
Organizations utilizing affected CamaleonCMS versions should immediately implement mitigations including enforcing proper role validation checks on all profile actions within the admin users controller. The most effective immediate solution involves adding compensating ownership verification mechanisms that ensure users can only access profile information belonging to their own accounts or accounts they are explicitly authorized to manage. Additionally, implementing rate limiting and logging mechanisms around profile access endpoints can help detect and prevent automated enumeration attacks. System administrators should also consider applying the latest security patches provided by the CamaleonCMS development team, which typically include proper authorization enforcement and role-based access control implementations. The vulnerability highlights the critical importance of maintaining robust access control mechanisms and the necessity of comprehensive security testing, particularly focusing on authentication and authorization flows within web applications.