CVE-2026-120429

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via downloadprivatefile, and us...

CVE-2026-120429 Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via downloadprivatefile, and us...

CVE-2026-120429

Camaleon CMS versions prior to 2.9.2 are vulnerable to a missing authorization flaw within the Admin::MediaController component. This vulnerability allows authenticated users with low privileges to bypass role-based Media permissions . Exploitation enables an attacker to perform unauthorized acti...

EUVD-2026-115238

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via downloadprivatefile, and us...