CVE-2026-73326

Deferred Deferred - Pending Action

CamaleonCMS Missing Authorization in Plugin Settings

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: VulnCheck

Description

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration parameters at runtime across the attack, front_cache, cama_meta_tag, and cama_contact_form plugins to alter cached page behavior, modify public meta-tag output, or reconfigure contact forms, enabling account takeover when chained with stored cross-site scripting through the contact form's before_html field.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73326

EUVD

EUVD-2026-57416

Affected Vendors & Products

Vendor	Product	Version / Range
camaleoncms	camaleoncms	*
camaleoncms	front_cache	*
camaleoncms	cama_meta_tag	*
camaleoncms	cama_contact_form	*
camaleoncms	camaleoncms	to 2.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CamaleonCMS has a missing authorization vulnerability where any authenticated low-privileged user can access and modify plugin settings through four unprotected endpoints. These endpoints control plugins like attack, front_cache, cama_meta_tag, and cama_contact_form. Attackers can change plugin configurations at runtime, affecting cached pages, meta tags, or contact forms.

Detection Guidance

Check for unauthorized access to plugin-administration endpoints by monitoring requests to /plugins/attack, /plugins/front_cache, /plugins/cama_meta_tag, and /plugins/cama_contact_form. Look for low-privileged users making configuration changes or modifying plugin parameters.

Impact Analysis

This vulnerability allows attackers to manipulate plugin settings, alter cached page behavior, modify public meta-tag output, or reconfigure contact forms. It can be chained with stored cross-site scripting via the contact form's before_html field to enable account takeover.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of plugin settings, potentially exposing sensitive user data. For GDPR, this may result in violations of data integrity and confidentiality requirements. For HIPAA, it could compromise protected health information if contact forms or cached pages handle such data.

Mitigation Strategies

Upgrade CamaleonCMS to a version above 2.9.1 where the authorization checks are fixed. If an upgrade is not immediately possible, restrict access to the vulnerable plugin endpoints via web server rules or firewall configurations.

Hi! I’m here to help you understand CVE-2026-73326. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70