CVE-2026-73326: Missing Authorization in owen2345 CamaleonCMS
CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration parameters at runtime across the attack, front_cache, cama_meta_tag, and cama_contact_form plugins to alter cached page behavior, modify public meta-tag output, or reconfigure contact forms, enabling account takeover when chained with stored cross-site scripting through the contact form's before_html field.
AI Analysis
Technical Summary
CVE-2026-73326 is a missing authorization vulnerability in CamaleonCMS that permits authenticated users with low privileges to access and modify plugin settings through four unprotected plugin-administration endpoints. The affected plugins include attack, front_cache, cama_meta_tag, and cama_contact_form. Attackers can manipulate runtime plugin configurations to change cached page behavior, modify meta-tag outputs, and reconfigure contact forms. This vulnerability can be chained with stored cross-site scripting in the contact form's before_html field to achieve account takeover.
Potential Impact
The vulnerability allows low-privileged authenticated users to bypass authorization controls and modify critical plugin settings, potentially disrupting site behavior and enabling further attacks such as account takeover when combined with stored XSS. This elevates the risk of unauthorized access and manipulation of site functionality.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to plugin administration endpoints to trusted users only and monitor for suspicious activity related to plugin configuration changes.
CVE-2026-73326: Missing Authorization in owen2345 CamaleonCMS
Description
CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration parameters at runtime across the attack, front_cache, cama_meta_tag, and cama_contact_form plugins to alter cached page behavior, modify public meta-tag output, or reconfigure contact forms, enabling account takeover when chained with stored cross-site scripting through the contact form's before_html field.
CVSS v4.0
Score 7.2high
Affected software
owen2345
CamaleonCMS
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-73326 is a missing authorization vulnerability in CamaleonCMS that permits authenticated users with low privileges to access and modify plugin settings through four unprotected plugin-administration endpoints. The affected plugins include attack, front_cache, cama_meta_tag, and cama_contact_form. Attackers can manipulate runtime plugin configurations to change cached page behavior, modify meta-tag outputs, and reconfigure contact forms. This vulnerability can be chained with stored cross-site scripting in the contact form's before_html field to achieve account takeover.
Potential Impact
The vulnerability allows low-privileged authenticated users to bypass authorization controls and modify critical plugin settings, potentially disrupting site behavior and enabling further attacks such as account takeover when combined with stored XSS. This elevates the risk of unauthorized access and manipulation of site functionality.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to plugin administration endpoints to trusted users only and monitor for suspicious activity related to plugin configuration changes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-11T21:47:14.059Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a7cc90bbf8831d539077323
Added to database: 08/12/2026, 19:27:07 UTC
Last enriched: 08/12/2026, 19:41:50 UTC
Last updated: 09/26/2026, 01:47:44 UTC
Views: 44
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.