CVE-2026-67616 describes a missing authorization vulnerability in Camaleon CMS through version 2.9.2. The vulnerability exists on the drafts endpoint, where authenticated low-privileged users can bypass role and permission checks to create draft posts. This is possible by sending requests authenticated only with a valid session, allowing unauthorized draft creation that appears in the administrative drafts queue. The vulnerability was fixed in commit 88ab703. No official remediation level or patch link is provided in the data, but the fix is referenced by the commit identifier.

An attacker with any authenticated low-privileged account can create draft posts without proper authorization. These unauthorized drafts appear in the administrative drafts queue, potentially leading to unauthorized content injection or workflow disruption. The vulnerability does not allow privilege escalation or direct administrative access but could be leveraged to interfere with content management processes.

A fix is available as indicated by the referenced commit 88ab703. Users should upgrade Camaleon CMS to a version that includes this commit or later. Since no official patch link or advisory is provided, users should consult the vendor's repository or official channels to apply the fix. Until patched, restrict authenticated user permissions as much as possible to limit exploitation potential.