Log in Start free

Vulnerability · Published Sep 29, 2026 · Assigned by VulDB

CVE-2026-102261owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in Camaleon CMS from owen2345. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 77.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.

Affected products (as reported)

VendorProductVersions
owen2345 Camaleon CMS 2.9.02.9.12.9.2

Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C

References