Privilege Escalation Vulnerability in CamaleonCMS by Owen2345

CVE-2026-56721

What is CVE-2026-56721?

The CamaleonCMS application, as of version 2.9.2 and earlier, is vulnerable to a privilege escalation flaw stemming from insecure direct object reference (IDOR). This vulnerability enables authenticated low-privileged attackers to manipulate user credentials. By exploiting a confusion between the authorization filter and action body within the UsersController, an attacker can submit a malicious PATCH request via the updated_ajax endpoint. This request allows them to pass an ID that corresponds to their own user account, circumventing self-authorization, while simultaneously indicating a victim’s user ID in params[:user_id]. As a result, the controller unwittingly grants the attacker access to modify or overwrite the victim's account details, including administrative passwords, potentially leading to a complete compromise of the site.

References