CVE-2026-67616: fallo de gravedad media en owen2345 camaleon-cms
Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.4%
Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only session authentication to create unauthorized drafts that appear in the administrative drafts queue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
owen2345 · camaleon-cmsCVEs relacionadas — owen2345 camaleon-cms
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-46986CRITICALArbitrary file write leading to RCE in Camaleon CMSEPSS 37.1%CVE-2024-46987HIGHArbitrary path traversal in Camaleon CMSEPSS 14.6%CVE-2026-66748HIGHCamaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom FieldEPSS 1.1%CVE-2025-2304CRITICALCamaleon CMS Privilege EscalationEPSS 0.6%CVE-2026-116009HIGHCamaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url ActionEPSS 0.4%