CVE-2026-67616: Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint
Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only session authentication to create unauthorized drafts that appear in the administrative drafts queue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Camaleon CMSto a version that resolves this vulnerability.Fixed in 2.9.2Patch 88ab703
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67616?
CVE-2026-67616 has a medium severity rating of 4.3.
What does CVE-2026-67616 affect?
CVE-2026-67616 affects Camaleon CMS version 2.9.2.
How do I fix CVE-2026-67616?
To fix CVE-2026-67616, upgrade to Camaleon CMS version after commit 88ab703.
What is the nature of the vulnerability in CVE-2026-67616?
CVE-2026-67616 is a missing authorization vulnerability on the drafts endpoint.
Who is at risk from CVE-2026-67616?
Any authenticated low-privileged user can exploit CVE-2026-67616 to create draft posts without proper permissions.