CVE-2026-67616Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint
Updated under an hour ago ()
Does this affect you?
It affects owen2345 camaleon-cms. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only session authentication to create unauthorized drafts that appear in the administrative drafts queue.
- CVSS
- 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-862
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Aug 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
owen2345 camaleon-cms owen2345:camaleon_cms (from the name) | through 2.9.2; 88ab703b5ac041afb93a9993470aa366093c5311 not affected | CNA record |
References
- https://github.com/owen2345/camaleon-cms/pull/1196issue-tracking
- https://github.com/owen2345/camaleon-cms/commit/88ab703b5ac041afb93a9993470aa366093c5311patch
- https://www.vulncheck.com/advisories/camaleon-cms-missing-authorization-via-admin-post-type-drafts-endpointthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.