CVE-2026-56721

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action body in the UsersController. Attackers can send a PATCH request to the updated_ajax endpoint setting params[:id] to their own user ID to pass the self-authorization check while simultaneously setting params[:user_id] to a victim's ID, causing the controller to load and mutate the victim's account, including overwriting administrator passwords to achieve full site takeover.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-25)

CWE

CWE-639

Published

2026-08-11

Modified

2026-10-24

Record from

the NVD, synced 2026-10-24

References

• https://github.com/owen2345/camaleon-cms
• https://github.com/owen2345/camaleon-cms/commit/26345034523a505cb01615509b7f0a665e89ae3e
• https://github.com/owen2345/camaleon-cms/pull/1185
• https://www.vulncheck.com/advisories/camaleoncms-privilege-escalation-via-parameter-confusion-in-userscontroller

Check your stackJSON