Live › vulnerability › CVE-2026-120430
Camaleon CMS before 2.9.2 has an insecure direct object reference in its admin categories controller. An authenticated user authorized for one post type can rename or delete categories belonging to other post types by supplying their IDs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Sites running Camaleon CMS older than 2.9.2 where admin users hold permissions for only some post types. Exposure requires an authenticated account, so sites with only trusted administrators carry less risk. unknown for other configuration details.
No product ranges from the sources yet.
camaleon_cms entry in the lockfile2.9.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.
This page as .md · .json · in your agent: get_signal("CVE-2026-120430")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.