Threats affecting pkg:gem/Camaleon CMS

CVE-2026-120430 is an insecure direct object reference vulnerability in Camaleon CMS versions before 2.9.2. It allows authenticated users with limited permissions to modify or delete categories they are not authorized to access by manipulating category IDs in update or destroy requests. The flaw affects the Admin::CategoriesController and is fixed in version 2.9.2.

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.