{"id":"CVE-2026-120430","kind":"vulnerability","aliases":["CVE-2026-120430"],"related":[],"title":"Camaleon CMS: low-privilege users can rename or delete other categories","description":"Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.","summary":"Camaleon CMS before 2.9.2 has an insecure direct object reference in its admin categories controller. An authenticated user authorized for one post type can rename or delete categories belonging to other post types by supplying their IDs.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["camaleon-cms","other","ruby-on-rails","self-hosted"],"not_affected_if":["camaleon-cms-2.9.2-or-later","no-authenticated-users"],"how_to_check":"- Check the installed Camaleon CMS version in the project's Gemfile.lock or `camaleon_cms` entry in the lockfile","fix":"- Upgrade Camaleon CMS to `2.9.2` or later","status":"open","published_at":"2026-11-02T15:17:24+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","triaged_at":"2026-11-02T15:26:25+00:00","updated_at":"2026-11-02T15:26:25+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-02T15:26:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Camaleon CMS to `2.9.2` or later","reach":"internet","title":"Camaleon CMS: low-privilege users can rename or delete other categories","impact":"medium","summary":"Camaleon CMS before 2.9.2 has an insecure direct object reference in its admin categories controller. An authenticated user authorized for one post type can rename or delete categories belonging to other post types by supplying their IDs.","audience":"businesses","category":"other","nicknames":[],"who_cares":["camaleon-cms","ruby-on-rails","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users rename or delete categories outside their permissions","analyst_note":"","how_to_check":"- Check the installed Camaleon CMS version in the project's Gemfile.lock or `camaleon_cms` entry in the lockfile\n- unknown for other checks","plain_action":"","needs_analyst":false,"not_affected_if":["camaleon-cms-2.9.2-or-later","no-authenticated-users"],"who_is_affected":"Sites running Camaleon CMS older than 2.9.2 where admin users hold permissions for only some post types. Exposure requires an authenticated account, so sites with only trusted administrators carry less risk. unknown for other configuration details.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":4199,"output_tokens":502,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120430':15A,18A '-2026':14A,17A '2.9.2':33B,70C 'admin':42B,79C 'allow':82C 'anoth':107C 'arbitrari':91C 'authent':46B,83C 'author':48B,95C,112C 'belong':58B 'camaleon':1A,20B,30B,67C 'camaleon-cm':19B 'categori':12A,43B,57B,88C,92C,108C,120C 'categoriescontrol':80C 'cms':2A,21B,31B,68C 'contain':71C 'control':44B 'cve':13A,16A 'delet':10A,56B,119C 'destroy':104C 'direct':37B,74C 'host':29B 'id':66B,93C,109C,115C 'insecur':36B,73C 'low':4A 'low-privileg':3A 'modifi':86C 'object':38B,75C 'one':50B,97C 'pair':106C 'post':51B,61B,98C,113C 'privileg':5A 'rail':26B 'refer':39B,76C 'referenc':90C 'renam':8A,54B,117C 'request':105C 'rubi':24B 'ruby-on-rail':23B 'self':28B 'self-host':27B 'send':101C 'suppli':64B 'type':52B,62B,99C,114C 'unauthor':87C 'updat':102C 'user':6A,47B,84C,94C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Sites running Camaleon CMS older than 2.9.2 where admin users hold permissions for only some post types. Exposure requires an authenticated account, so sites with only trusted administrators carry less risk. unknown for other configuration details.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["camaleoncms","medium","other","rubyonrails","selfhosted"],"first_public_at":"2026-11-02T15:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120430","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120430","severity":null,"published_at":"2026-11-02T15:17:24+00:00","modified_at":"2026-11-02T15:17:24+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","fetched_at":"2026-11-02T15:24:01+00:00","note":null}],"documents":[{"id":52450,"url":"https://github.com/owen2345/camaleon-cms/commit/fa465e994bcbf4e7be4605853c204b73dea7bbc5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52448,"url":"https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":52452,"url":"https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.2-idor-via-admin-categoriescontroller","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}