CVE-2026-56720 describes a missing authorization vulnerability in CamaleonCMS up to version 2.9.2. Authenticated users can supply arbitrary user ID parameters to the admin profile endpoint, bypassing role validation filters and ownership checks. This enables disclosure of profile information for any user, including privileged accounts, through sequential integer user IDs in GET requests.

The vulnerability allows authenticated users to access sensitive profile information of other users, including administrators, which could lead to information disclosure and potential further attacks based on exposed data. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required beyond authentication, and low impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to the admin profile endpoint or implement compensating controls such as ownership checks and role validation filters on the profile action.