CVE-2026-56721: CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController
CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action body in the UsersController. Attackers can send a PATCH request to the updatedajax endpoint setting params[:id] to their own user ID to pass the self-authorization check while simultaneously setting params[:userid] to a victim's ID, causing the controller to load and mutate the victim's account, including overwriting administrator passwords to achieve full site takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CamaleonCMSto a version that resolves this vulnerability.Fixed in 2.9.2 - Compensating control
Limit authenticated access to the CamaleonCMS UsersController/updated_ajax endpoint to trusted/administrative users only (e.g., via network/WAF/ACL rules) until a fixed version is deployed, to reduce the chance of parameter-confusion exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56721?
CVE-2026-56721 has a severity score of 8.8, classified as high.
How does CVE-2026-56721 affect CamaleonCMS?
CVE-2026-56721 allows authenticated low-privileged attackers to escalate their privileges and overwrite any user's credentials.
How do I fix CVE-2026-56721?
To fix CVE-2026-56721, update to CamaleonCMS version 2.9.3 or later, where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-56721?
CVE-2026-56721 is categorized as a privilege escalation vulnerability due to parameter confusion.
What versions of CamaleonCMS are affected by CVE-2026-56721?
CVE-2026-56721 affects CamaleonCMS version 2.9.2 and earlier.