CVE-2026-56720: CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators, due to the profile action being excluded from the role validation filter with no compensating ownership check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CamaleonCMSto a version that resolves this vulnerability.Fixed in 2.9.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56720?
CVE-2026-56720 has a medium severity rating of 4.3.
How do I fix CVE-2026-56720?
To fix CVE-2026-56720, upgrade CamaleonCMS to version 2.9.3 or later, which patches the missing authorization issue.
What is the impact of CVE-2026-56720?
CVE-2026-56720 allows authenticated users to access other users' profile data without proper authorization.
Who is affected by CVE-2026-56720?
CVE-2026-56720 affects all users of CamaleonCMS version 2.9.2 and earlier.
How can attackers exploit CVE-2026-56720?
Attackers can exploit CVE-2026-56720 by submitting a GET request to the admin profile endpoint with an arbitrary user ID.