PT-2026-135445

CVE-2026-120429

·

Published

2026-11-02

·

Updated

2026-11-02

Description by

CVSS 3.1
7.1
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download private file, and use crop with saved avatar to change other users' avatars.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-862: Missing Authorization
Related identifiers
CVE-2026-120429
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com