Insecure Direct Object Reference in Camaleon CMS Admin
CVE-2026-120430

5.3MEDIUM

Key Information:

Vendor

Owen2345

Status
Camaleon Cms
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120430?

Camaleon CMS versions before 2.9.2 are susceptible to an insecure direct object reference in the Admin::CategoriesController. This vulnerability enables authenticated users to access and modify categories they are not authorized to alter by using arbitrary category IDs in their update or destroy requests. Users with permissions for a specific post type can exploit this flaw, allowing unintended renaming or deletion of categories, which may impact the integrity of the content management system.

Affected Version(s)

Camaleon CMS 0 < 2.9.2

References

https://github.com/owen2345/camaleon-cms/pull/1148
patchissue-tracking
https://github.com/owen2345/camaleon-cms/commit/fa465e994...
patch
https://github.com/owen2345/camaleon-cms/blob/2.9.1/app/c...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Seoyoung Kang (AhnLab, Inc.)
texpert
.