CVE-2026-67616 · Symaro Security Advisory

Description

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only session authentication to create unauthorized drafts that appear in the administrative drafts queue.

Severity (CVSS)

Base score	5.3
Severity	Medium
Version	CVSS 4.0
Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Provided by	CNA

Weaknesses

CWE-862 — Missing Authorization

Affected products

Vendor	Product	Versions
owen2345	camaleon-cms	0 to <=2.9.2; 88ab703b5ac041afb93a9993470aa366093c5311

References

https://github.com/owen2345/camaleon-cms/pull/1196 (issue-tracking)
https://github.com/owen2345/camaleon-cms/commit/88ab703b5ac041afb93a9993470aa366093c5311 (patch)
https://www.vulncheck.com/advisories/camaleon-cms-missing-authorization-via-admin-post-type-drafts-endpoint (third-party-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 04 Aug 2026 07:02 UTC.