Threats tagged 'ghsa-w2c5-xppr-2hh6'

Camaleon CMS versions prior to 2.9.2 have a missing authorization vulnerability in the Admin::MediaController. This flaw allows authenticated users with low privileges to bypass role-based media permissions, enabling unauthorized file uploads, access to private media files, and modification of other users' avatars.