Missing Authorization Vulnerability in Camaleon CMS Admin Media Controller
CVE-2026-120429

7.1HIGH

Key Information:

Vendor

Owen2345

Status
Camaleon Cms
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120429?

Camaleon CMS prior to version 2.9.2 has a vulnerability in the Admin::MediaController that permits low-privileged authenticated users to bypass role-based media permissions. This flaw allows attackers to POST files to /admin/media/upload, access private media through the download_private_file function, and modify the avatars of other users using the crop function in saved_avatar. This vulnerability may lead to unauthorized access and manipulation of sensitive media files, requiring immediate attention and remediation.

Affected Version(s)

Camaleon CMS 0 < 2.9.2

References

https://github.com/owen2345/camaleon-cms/pull/1147
patchissue-tracking
https://github.com/owen2345/camaleon-cms/commit/7fe4fa0bf...
patch
https://github.com/owen2345/camaleon-cms/blob/2.9.1/app/c...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Seoyoung Kang (AhnLab, Inc.)
texpert
.