---
id: "CVE-2026-120430"
kind: "vulnerability"
aliases: ["CVE-2026-120430"]
title: "Camaleon CMS: low-privilege users can rename or delete other categories"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["camaleon-cms", "other", "ruby-on-rails", "self-hosted"]
not_affected_if: ["camaleon-cms-2.9.2-or-later", "no-authenticated-users"]
published_at: "2026-11-02T15:17:24+00:00"
first_seen_at: "2026-11-02T15:24:01+00:00"
updated_at: "2026-11-02T15:26:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120430", "first_seen_at": "2026-11-02T15:24:01+00:00"}]
---

# Camaleon CMS: low-privilege users can rename or delete other categories

Camaleon CMS before 2.9.2 has an insecure direct object reference in its admin categories controller. An authenticated user authorized for one post type can rename or delete categories belonging to other post types by supplying their IDs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Camaleon CMS version in the project's Gemfile.lock or `camaleon_cms` entry in the lockfile

## Fix

- Upgrade Camaleon CMS to `2.9.2` or later

## Timeline

- 2026-11-02T15:24:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120430

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.2-idor-via-admin-categoriescontroller
- [fix] Patch: github.com https://github.com/owen2345/camaleon-cms/commit/fa465e994bcbf4e7be4605853c204b73dea7bbc5
- [fix] Release notes: github.com https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2

## From the sources

Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_