Owen2345

CVE-2026-120429: Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the

CVE-2026-120429 Nov 2, 2026 Source: Vendor

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-120429

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line

Showing 1–1 of 1

CVE-2026-120429 BR2026-0000-041165 unclaimed

Credited as Seoyoung Kang (AhnLab, Inc.)