CVE-2021-25970: Tuzitio Camaleon CMS

High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days.

Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.

Affected products

• Tuzitio Camaleon CMS: from 0.1.7, up to and including 2.6.0

Published 2021-10-20. Last modified 2026-06-17.