CVE-2026-10715: Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint
Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary postid to POST /admin/posttype/<POSTTYPEID>/drafts and overwrite the draft associated with another user's post.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the server-side handling of POST /admin/post_type/<POST_TYPE_ID>/drafts to validate that the authenticated user is allowed to edit the post identified by post_id. Reject requests that reference posts the user does not own or for which they lack edit permissions; ensure post_id cannot be arbitrarily used to overwrite another user's draft.
Camaleon CMS administrator draft autosave endpoint (POST /admin/post_type/<POST_TYPE_ID>/drafts) authorization check / ownership validation = require edit permission on target post and verify user is post owner or has higher privilege - Compensating control
If a code fix cannot be deployed immediately, implement external controls such as WAF or reverse-proxy rules or firewall restrictions to block or require additional verification for requests to POST /admin/post_type/<POST_TYPE_ID>/drafts. Restrict access to the autosave endpoint to trusted/administrative users or trusted IP ranges until proper authorization checks are in place.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10715?
CVE-2026-10715 has a medium severity rating of 5.1 according to the CVSS score.
How do I fix CVE-2026-10715?
To fix CVE-2026-10715, ensure that only users with appropriate permissions can access the draft autosave endpoint.
What systems are affected by CVE-2026-10715?
CVE-2026-10715 affects Camaleon CMS version 2.9.2.
What type of vulnerability is CVE-2026-10715?
CVE-2026-10715 is classified as an improper authorization vulnerability.
What can an attacker do with CVE-2026-10715?
An attacker can exploit CVE-2026-10715 to overwrite drafts associated with other users' posts.