CVE-2026-56721

Name of the Vulnerable Software and Affected Versions CamaleonCMS versions prior to 2.9.3

Description An insecure direct object reference (IDOR) allows authenticated low-privileged attackers to escalate privileges by exploiting a parameter confusion flaw in the UsersController between the authorization filter and the action body. By sending a PATCH request to the 'updated ajax' endpoint, an attacker can set the id parameter to their own user ID to bypass self-authorization checks while setting the user id parameter to a victim's ID. This causes the controller to load and modify the victim's account, enabling the attacker to overwrite administrator passwords and achieve full site takeover.

Recommendations Update CamaleonCMS to version 2.9.3 or later.