Live › vulnerability › CVE-2026-120429
Camaleon CMS before 2.9.2 has a missing authorization check in its admin media controller. A low-privileged logged-in user can upload files, read private media, and change other users' avatars.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Sites running Camaleon CMS before 2.9.2 where ordinary authenticated users have accounts. The flaw is in the admin media endpoints, so exposure depends on whether low-privileged roles can reach them. Sites without Camaleon CMS or already on 2.9.2 or later can skip it.
No product ranges from the sources yet.
camaleon_cms; versions below 2.9.2 are affected.Admin::MediaController routes reachable at /admin/media/upload and download_private_file for non-admin roles.2.9.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.
This page as .md · .json · in your agent: get_signal("CVE-2026-120429")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.