CVE-2026-67616: falha de média gravidade em owen2345 camaleon-cms
Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only session authentication to create unauthorized drafts that appear in the administrative drafts queue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
owen2345 · camaleon-cmsCVEs relacionadas — owen2345 camaleon-cms
No mesmo produto, das mais perigosas para as menos.
CVE-2024-46986CRITICALArbitrary file write leading to RCE in Camaleon CMSEPSS 37.1%CVE-2024-46987HIGHArbitrary path traversal in Camaleon CMSEPSS 14.6%CVE-2026-66748HIGHCamaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom FieldEPSS 1.1%CVE-2025-2304CRITICALCamaleon CMS Privilege EscalationEPSS 0.6%CVE-2026-116009HIGHCamaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url ActionEPSS 0.4%