CVE-2026-56721 describes a privilege escalation vulnerability in CamaleonCMS (<=2.9.2) caused by an insecure direct object reference combined with a parameter confusion flaw in the UsersController. The vulnerability arises because the authorization filter checks params[:id] against the attacker's user ID, but the action body uses params[:user_id] to load and mutate the victim's account. By setting params[:id] to their own user ID and params[:user_id] to a victim's ID in a PATCH request to the updated_ajax endpoint, an attacker can bypass authorization and overwrite victim credentials, including administrator passwords, enabling full site compromise.

An authenticated attacker with low privileges can escalate their privileges to administrator by overwriting any user's credentials. This leads to complete site takeover, compromising confidentiality, integrity, and availability of the affected CamaleonCMS installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious PATCH requests to the updated_ajax endpoint. Consider implementing additional authorization checks to ensure params[:user_id] matches the authenticated user's ID.