Vulnerability Description
CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action body in the UsersController. Attackers can send a PATCH request to the updated_ajax endpoint setting params[:id] to their own user ID to pass the self-authorization check while simultaneously setting params[:user_id] to a victim's ID, causing the controller to load and mutate the victim's account, including overwriting administrator passwords to achieve full site takeover.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/owen2345/camaleon-cms
- https://github.com/owen2345/camaleon-cms/commit/26345034523a505cb01615509b7f0a66
- https://github.com/owen2345/camaleon-cms/pull/1185
- https://www.vulncheck.com/advisories/camaleoncms-privilege-escalation-via-parame
FAQ
What is CVE-2026-56721?
CVE-2026-56721 is a vulnerability with a CVSS score of 8.8 (HIGH). CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user...
How severe is CVE-2026-56721?
CVE-2026-56721 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56721?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.