CVE-2026-56720
CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 11, 2026
- Updated
- Aug 14, 2026
- Reserved
- Jun 22, 2026
Description
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators, due to the profile action being excluded from the role validation filter with no compensating ownership check.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
CamaleonCMSowen2345 |
|
References
- Pull Requestissue-tracking
- Product Repositoryproduct
- Patch Commitpatch
- https://www.vulncheck.com/advisories/camaleoncms-and-earlier-missing-authorization-via-profile-actionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.