CVE-2026-56720

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators, due to the profile action being excluded from the role validation filter with no compensating ownership check.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/owen2345/camaleon-cms
https://github.com/owen2345/camaleon-cms/commit/ae10da7cfce902a8552927c57b0a562fb1676040
https://github.com/owen2345/camaleon-cms/pull/1197
https://www.vulncheck.com/advisories/camaleoncms-and-earlier-missing-authorization-via-profile-action

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) CamaleonCMS versión 2.9.2 y anteriores contiene una vulnerabilidad de autorización faltante en el controlador de usuarios administradores que permite a cualquier usuario autenticado acceder a los datos de perfil de cualquier otro usuario al proporcionar un parámetro de ID de usuario arbitrario. Los atacantes pueden enviar una solicitud GET al endpoint de perfil de administrador con un ID de usuario entero secuencial enumerable para divulgar información de perfil de cualquier usuario, incluidos los administradores, debido a que la acción de perfil está excluida del filtro de validación de roles sin una comprobación de propiedad compensatoria.

Information

Published : 2026-08-11 16:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-56720

Mitre link : CVE-2026-56720

CVE.ORG link : CVE-2026-56720

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-56720", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56720", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T16:59:33.310616Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "owen2345", "product": "CamaleonCMS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.9.2"}, {"status": "unaffected", "version": "ae10da7", "versionType": "custom"}], "defaultStatus": "affected"}]}], "published": "2026-08-11T16:17:33.403", "references": [{"url": "https://github.com/owen2345/camaleon-cms", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/owen2345/camaleon-cms/commit/ae10da7cfce902a8552927c57b0a562fb1676040", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/owen2345/camaleon-cms/pull/1197", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/camaleoncms-and-earlier-missing-authorization-via-profile-action", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators, due to the profile action being excluded from the role validation filter with no compensating ownership check."}, {"lang": "es", "value": "CamaleonCMS versi\u00f3n 2.9.2 y anteriores contiene una vulnerabilidad de autorizaci\u00f3n faltante en el controlador de usuarios administradores que permite a cualquier usuario autenticado acceder a los datos de perfil de cualquier otro usuario al proporcionar un par\u00e1metro de ID de usuario arbitrario. Los atacantes pueden enviar una solicitud GET al endpoint de perfil de administrador con un ID de usuario entero secuencial enumerable para divulgar informaci\u00f3n de perfil de cualquier usuario, incluidos los administradores, debido a que la acci\u00f3n de perfil est\u00e1 excluida del filtro de validaci\u00f3n de roles sin una comprobaci\u00f3n de propiedad compensatoria."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "disclosure@vulncheck.com"}