CVE-2026-56720

Medium

Description

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators, due to the profile action being excluded from the role validation filter with no compensating ownership check.

SeverityMedium

CVSS4.3

Exploit probability—

ProductCamaleonCMS

PublishedAug 11, 2026

First seenAug 11, 2026

Weakness typeCWE-862Missing authorization

How to fix

Patches

github.com/owen2345/camaleon-cms/commit/ae10da7cfce902a8552927c57b0a562fb1676040

Affected products

Product	Affected versions	Fixed in
owen2345 CamaleonCMS	v ≤ 2.9.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.