---
id: CVE-2026-120429
title: 'Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController'
summary: >-
  Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in
  Admin::MediaController that allows low-privileged authenticated users to
  bypass the role-based Media permission. Attackers can POST to
  /admin/media/upload to sto…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: owen2345
product: Camaleon CMS
affected:
  - camaleon_cms < 2.9.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T15:51:07.817487Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T15:51:20.616Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120429'
references:
  - url: 'https://github.com/owen2345/camaleon-cms/pull/1147'
  - url: >-
      https://github.com/owen2345/camaleon-cms/commit/7fe4fa0bf99256dfe32b5f674baf4f771606549e
  - url: >-
      https://github.com/owen2345/camaleon-cms/blob/2.9.1/app/controllers/camaleon_cms/admin/media_controller.rb
  - url: 'https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2'
    label: Camaleon CMS 2.9.2 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.2-missing-authorization-via-admin-mediacontroller
    label: >-
      VulnCheck Advisory: Camaleon CMS before 2.9.2 Missing Authorization via
      Admin::MediaController
tags:
  - cve.org
epss: 0.00347
epssPercentile: 0.28417
ingestedAt: '2026-11-05T19:30:42.698Z'
---

## Overview

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.

## Affected

- `camaleon_cms < 2.9.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.