What is CVE-2026-120429 in Camaleon CMS?

CVE-2026-120429 is a high-severity authorization vulnerability affecting Camaleon CMS before version 2.9.2, carrying a CVSS base score of 7.1. Similar security flaws in software components often require urgent attention, comparable to issues found when assessing escalada de privilegios.

The flaw originates in Admin::MediaController, where a missing authorization check allows authenticated users with low privileges to completely bypass role-based media permissions. This security oversight resembles permissions issues examined in reports on escalada de privilegios local and related controller vulnerabilities.

Exploiting this flaw grants attackers unauthorized capabilities. Malicious actors can send POST requests to upload files, read private media through download_private_file, and manipulate user avatars by leveraging the crop function with saved_avatar, echoing concerns found in analyses of vulnerabilidades use-after-free.

Who is affected by this media controller vulnerability?

Low-privileged authenticated users targeting instances running Camaleon CMS prior to version 2.9.2 are directly impacted by this missing authorization flaw. Any environment utilizing default role configurations without prior remediation remains vulnerable to unauthorized media manipulation.

Administrators maintaining web applications built on unpatched versions face potential data exposure risks, as sensitive files can be downloaded and user avatars modified without administrative consent.

How do I secure my application against this flaw?

Mitigating CVE-2026-120429 requires applying the official security patch provided by the maintainers in the latest release. Review your application dependencies and ensure your deployment pipeline incorporates up-to-date packages.

Follow these mitigation steps to secure your Camaleon CMS deployment:

  1. Identify the current running version of Camaleon CMS in your application environment.
  2. Update the gem or package dependency to version 2.9.2 or higher.
  3. Verify that Admin::MediaController enforces proper role-based permissions after upgrading.
  4. Audit upload directories and user avatar assignments for any unauthorized modifications.