Read the docs
TI-2026-47770 Aliases CVE-2026-67616GHSA-hwrq-jcj5-6vc6

Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint

Priority LOW 24CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only session authentication to create unauthorized drafts that appear in the administrative drafts queue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0044 38th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
owen2345camaleon-cmsup to 2.9.2—Patch availableCNA
  • camaleon-cms Vendorowen2345 Affected up to 2.9.2 Fixed in — Patch available CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-67616
  2. 2026-10-03 Alias added: GHSA-hwrq-jcj5-6vc6

References

Patch 1

Other 1

  • TI-2023-14148 Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI)… CVSS 3.1CRITICAL 9.8
  • TI-2024-31375 Arbitrary file write leading to RCE in Camaleon CMS CVSS 3.1CRITICAL 10.0
  • TI-2026-47396 Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field CVSS 4.0HIGH 8.7
  • TI-2021-07976 Camaleon CMS - Insufficient Session Expiration after Password Change CVSS 3.1HIGH 8.8
  • TI-2024-31376 Arbitrary path traversal in Camaleon CMS CVSS 3.1HIGH 7.7
  • TI-2026-51449 CamaleonCMS Missing Authorization via Plugin Administration Endpoints CVSS 4.0HIGH 7.2
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences