CVE-2026-10715
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary post_id to POST /admin/post_type/<POST_TYPE_ID>/drafts and overwrite the draft associated with another user's post.
Risk Assessment
The risk involves unauthorized overwriting of other users' drafts, potentially leading to data loss, content integrity compromise, and privilege escalation within the CMS.
Recommendation
Immediately update Camaleon CMS to the latest version that includes a fix for this vulnerability. Until then, restrict access to the /admin/post_type/<POST_TYPE_ID>/drafts endpoint to trusted administrators only.
Other vulnerabilities in Camaleon CMS
See all- CVE-2026-67616Medium
Camaleon CMS up to version 2.9.2 (fixed in commit 88ab703) contains a missing authorization vulnerability on the drafts endpoint. Any authenticated low-privileged user can create draft posts by bypassing role and permission checks, sending requests to the drafts endpoint using only session authentication.
- CVE-2026-66748High
A vulnerability in Camaleon CMS allows an authenticated user with custom field management permissions to execute arbitrary Ruby code. A malicious expression in the select_eval field is evaluated via instance_eval when rendering the post edit page.
- CVE-2026-1776Medium
A path traversal vulnerability in Camaleon CMS versions 2.4.5.0 through 2.9.0 (prior to commit f54a77e) in the AWS S3 uploader implementation. Authenticated users can read arbitrary files from the web server's filesystem by manipulating the 'file' parameter in the download_private_file function.
Original NVD description (English source)
Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary post_id to POST /admin/post_type/<POST_TYPE_ID>/drafts and overwrite the draft associated with another user's post.