Description

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration parameters at runtime across the attack, front_cache, cama_meta_tag, and cama_contact_form plugins to alter cached page behavior, modify public meta-tag output, or reconfigure contact forms, enabling account takeover when chained with stored cross-site scripting through the contact form's before_html field.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-12T20:17:54.887Z",
  "pubdate": "2026-08-12T20:17:54.887Z",
  "executiveSummary": "CamaleonCMS contains a missing authorization vulnerability that enables low-privileged authenticated users to access and modify critical plugin settings. The flaw stems from four unprotected plugin-administration endpoints that fail to enforce proper role-based access control or administrator-level authorization checks.\nBy targeting these insecure endpoints, an attacker can manipulate runtime configuration parameters across multiple plugins, specifically attack, front_cache, cama_meta_tag, and cama_contact_form. This unauthorized modification allows threat actors to alter cached page behavior, manipulate public meta-tag output, and reconfigure contact forms.\nThe risk implications are significant when the vulnerability is chained with other attack vectors, such as stored cross-site scripting via the contact form's before_html field, which can ultimately facilitate account takeover. Exploitation requires low-privileged authentication to interact directly with the vulnerable administrative endpoints over the network.\nOrganizations utilizing CamaleonCMS face potential data integrity issues, unauthorized administrative configuration changes, and compromise of user sessions if these endpoints remain exposed without adequate access control enforcement.",
  "technicalDetails": "The vulnerability is caused by a missing authorization check within CamaleonCMS plugin-administration routing and controller logic. Specifically, four administrative endpoints designated for plugin management lack proper access control validation, allowing any authenticated low-privileged user to issue HTTP requests and invoke administrative functions typically restricted to administrators.\nThe affected components comprise four distinct plugins: attack, front_cache, cama_meta_tag, and cama_contact_form. The application fails to verify whether the requesting user possesses administrative privileges before processing configuration update requests directed at these modules.\nThe attack flow proceeds as follows: First, an authenticated attacker with low privileges identifies the unprotected plugin-administration endpoints. Second, the attacker transmits crafted HTTP requests to these endpoints to modify runtime configuration parameters. For example, parameters associated with the front_cache plugin can be altered to manipulate cached page behavior, while parameters in the cama_meta_tag plugin allow modification of public meta-tag output.\nFurthermore, the attacker can reconfigure the cama_contact_form plugin by injecting payloads into input fields such as the before_html field. When chained with stored cross-site scripting vulnerabilities present within the contact form functionality, this unauthorized reconfiguration permits the execution of malicious scripts in the context of other users or administrators.\nThe post-exploitation impact includes unauthorized alteration of application behavior, defacement or manipulation of public-facing content through meta-tag injection, poisoning of page caches, and potential session hijacking or account takeover resulting from the execution of stored cross-site scripting payloads."
}