CVE-2026-120429: Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController

Published Nov 2, 2026

Updated

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via downloadprivatefile, and use crop with savedavatar to change other users' avatars.

Event History

Nov 2, 2026

CVE Published

via OSV·02:28 PM

Data Sourced

via OSV·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A low-privileged authenticated Camaleon CMS user can exploit it. The attacker must be able to send requests to the administrative media endpoints; no user interaction is required.

What actions can an attacker perform?

An attacker can upload and store files by POSTing to /admin/media/upload, read private media through download_private_file, and change other users' avatars by using crop with saved_avatar.

Are deployments before version 2.9.2 affected?

Camaleon CMS versions before 2.9.2 are affected. The vulnerability bypasses the role-based Media permission, so users who should not have Media access may still reach the vulnerable functions.

CVE-2026-120429: Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController

Event History

Frequently Asked Questions

Who can exploit this issue?

What actions can an attacker perform?

Are deployments before version 2.9.2 affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What actions can an attacker perform?

Are deployments before version 2.9.2 affected?