CVE-2026-102261— owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization
Quick assessment
Affected
owen2345 Camaleon CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorizatio
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102261
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| owen2345 | Camaleon CMS | 2.9.0 |
cpe:2.3:a:owen2345:camaleon_cms:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-102261
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102261
请登录查看更多情报信息。
Other References for CVE-2026-102261 (2)
IV. Related Vulnerabilities
Same vendor: owen2345
-
CVE-2026-86100
Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in U -
CVE-2026-73326
CamaleonCMS Missing Authorization via Plugin Administration -
CVE-2026-73332
CamaleonCMS cama_contact_form Plugin Stored XSS via before_h -
CVE-2026-73331
CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug -
CVE-2026-73330
CamaleonCMS 2.9.1 Server-Side Template Injection via test_em
Same weakness: CWE-639
-
CVE-2026-97685
LimeSurvey Community Edition 7.3.0 - Cross-survey object aut -
CVE-2026-102373
GestSup before 3.2.62 Private Ticket Comment Disclosure via -
CVE-2026-82323
Improper Authorization in Enocta Educational's Enocta Platfo -
CVE-2026-82348
Apache Roller: Cross-weblog resource tampering via unscoped -
CVE-2026-100897
fuzui StudentInfo Password Change Endpoint moditypasswordstu
V. Comments for CVE-2026-102261
No comments yet