Missing Authorization in Camaleon CMS Allows Privilege Escalation

Executive Summary

CVE-2026-120429 is a missing authorization vulnerability in Camaleon CMS versions before 2.9.2. It affects the Admin::MediaController, allowing low-privileged authenticated users to bypass role-based media permissions. Attackers can exploit this to upload files, read private media, and change other users' avatars without proper authorization.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file uploads or access to /admin/media/upload, download_private_file, or crop actions in Camaleon CMS logs. Monitor for POST requests to these endpoints by low-privileged users. Verify if users without media permissions can access these functions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to perform actions like uploading malicious files, accessing private media, and altering user avatars. It could lead to data breaches, malware distribution, or account takeovers if exploited by attackers with low-level access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing private media (personal data) without authorization. For HIPAA, unauthorized access to media files may compromise protected health information. Non-compliance risks fines and legal penalties under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Camaleon CMS to version 2.9.2 or later to apply the authorization fix. Ensure all user roles have only necessary permissions, particularly the manage_media permission for media-related actions.

Useful 0 Not Useful 0