CVE-2026-56721: OWEN2345 Camaleoncms

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action body in the UsersController. Attackers can send a PATCH request to the updated_ajax endpoint setting params[:id] to their own user ID to pass the self-authorization check while simultaneously setting params[:user_id] to a victim's ID, causing the controller to load and mutate the victim's account, including overwriting administrator passwords to achieve full site takeover.

Affected products

• OWEN2345 Camaleoncms: up to and including 2.9.2

Published 2026-08-11. Last modified 2026-08-31.