CVE-2026-120429— Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController

Quick assessment

Affected

owen2345 Camaleon CMS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Camaleon CMS 2.9.2 之前的版本在中存在一个缺少授权检查的漏洞，使得低权限的已认证用户能够绕过基于角色的媒体权限控制。攻击者可以向发送 POST 请求以存储文件，通过读取私有媒体，并利用配合修改其他用户的头像。

CVSS 7.1 · High Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController

Source: CVE Program / CVE List V5

Vulnerability Description

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
owen2345	Camaleon CMS	0 ~ 2.9.2	-

II. Public POCs for CVE-2026-120429

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120429

请登录查看更多情报信息。

Vendor Pages for CVE-2026-120429 (1)

🔗 Release 2.9.2 · owen2345/camaleon-cms · GitHub Read full article release-notes

Other References for CVE-2026-120429 (4)

https://github.com/owen2345/camaleon-cms/commit/7fe4fa0bf99256dfe32b5f674baf4f771606549e patch
https://github.com/owen2345/camaleon-cms/pull/1147 patch issue-tracking
https://github.com/owen2345/camaleon-cms/blob/2.9.1/app/controllers/camaleon_cms/admin/media_controller.rb technical-description
https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.2-missing-authorization-via-admin-mediacontroller third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120429

IV. Related Vulnerabilities

Same product: Camaleon CMS

Same vendor: owen2345

Same weakness: CWE-862