CVE-2026-56721
Received Received - Intake

Privilege Escalation via IDOR in CamaleonCMS

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action body in the UsersController. Attackers can send a PATCH request to the updated_ajax endpoint setting params[:id] to their own user ID to pass the self-authorization check while simultaneously setting params[:user_id] to a victim's ID, causing the controller to load and mutate the victim's account, including overwriting administrator passwords to achieve full site takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-56721
EUVD
EUVD-2026-56236

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
owen2345 camaleon_cms to 2.9.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-56721 is a privilege escalation vulnerability in CamaleonCMS versions 2.9.2 and earlier. It involves an insecure direct object reference (IDOR) flaw where authenticated low-privileged attackers can manipulate parameters in a PATCH request to the updated_ajax endpoint. By setting params[:id] to their own user ID and params[:user_id] to a victim's ID, attackers bypass authorization checks and overwrite any user's credentials, including administrators, leading to full site takeover.

Detection Guidance

To detect this vulnerability, monitor HTTP PATCH requests to the /users/updated_ajax endpoint in CamaleonCMS versions 2.9.2 and earlier. Look for requests where params[:id] matches the attacker's user ID while params[:user_id] points to a different user, especially admin accounts. Check server logs for unusual password reset or credential modification events.

Impact Analysis

If you use CamaleonCMS version 2.9.2 or earlier, an attacker with low privileges could exploit this to take over any user account, including admin accounts. This could lead to unauthorized access, data theft, website defacement, or complete site compromise. Attackers can escalate privileges without needing high-level access initially.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in non-compliance due to potential data breaches, unauthorized modifications, and failure to protect user credentials and personal information.

Mitigation Strategies

Immediately upgrade CamaleonCMS to the latest patched version. If upgrading is not possible, apply the security patch from the official repository commit (26345034523a505cb01615509b7f0a665e89ae3e). Review and restrict access to the updated_ajax endpoint. Implement strict input validation for user ID parameters in all user management endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56721. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart