CVE-2026-102261: owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleoncms/admin/mediacontroller.rb of the component Media Crop Handler. This manipulation of the argument savedavatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
owen2345 Camaleon CMSto a version that resolves this vulnerability.Fixed in 2.9.3Patch c143e145caa600947e70a240e87f2fed889149d3
Event History
Frequently Asked Questions
Which deployments are affected?
Camaleon CMS versions up to 2.9.2 are affected. Version 2.9.3 is recommended to address the issue.
What access does an attacker need to exploit this?
The attack can be initiated remotely, but the assigned CVSS vector indicates low privileges are required. No user interaction is required.
What is the practical impact of successful exploitation?
Successful exploitation bypasses authorization in the Media Crop Handler through manipulation of the saved_avatar argument. The reported impact includes integrity and availability effects, with no reported confidentiality impact.
Is public exploit information available?
Yes. The exploit has been published and may be used.
What should teams do if they cannot upgrade immediately?
The provided information recommends upgrading the affected component to version 2.9.3. No alternative mitigation or workaround is provided.