Threats tagged 'ghsa-gxj9-c997-h74f'

Camaleon CMS versions prior to 2.9.2 have an insecure direct object reference (IDOR) vulnerability in the Admin::CategoriesController. This flaw allows authenticated users with permissions for one post type to modify or delete categories associated with other post types by manipulating category IDs in update or destroy requests. The vulnerability can lead to unauthorized category renaming or deletion.