CVE-2026-67616

Received Received - Intake

Unauthorized Draft Creation in Camaleon CMS

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only session authentication to create unauthorized drafts that appear in the administrative drafts queue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-67616

Affected Vendors & Products

Vendor	Product	Version / Range
camaleon_cms	camaleon_cms	to 2.9.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Camaleon CMS through version 2.9.2 has a missing authorization vulnerability in the drafts endpoint. This flaw allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can exploit this by sending requests to the drafts endpoint using only session authentication, creating unauthorized drafts that appear in the administrative drafts queue.

Detection Guidance

Check for unauthorized draft posts in the administrative drafts queue. Monitor requests to the drafts endpoint with session authentication only. Verify role and permission checks are enforced for draft creation.

Impact Analysis

This vulnerability allows unauthorized users to create draft posts, potentially leading to content manipulation, misinformation, or unauthorized changes. It may disrupt workflows by cluttering the drafts queue with illegitimate entries and could be used to plant malicious or misleading content before publication.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized content creation, which could violate data integrity and access control requirements in GDPR and HIPAA. Unauthorized drafts could lead to unauthorized data exposure or processing, potentially breaching confidentiality and integrity principles.

Mitigation Strategies

Update Camaleon CMS to the latest commit (88ab703) or newer version to fix the missing authorization issue. Ensure proper role and permission checks are enforced on the drafts endpoint.

Hi! I’m here to help you understand CVE-2026-67616. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70