CVE-2026-102261: Camaleon CMS Auth Bypass Vulnerability

CVE-2026-102261 Overview

CVE-2026-102261 is an authorization bypass vulnerability in owen2345 Camaleon CMS versions up to and including 2.9.2. The flaw resides in the crop function of app/controllers/camaleon_cms/admin/media_controller.rb, part of the Media Crop Handler component. An authenticated attacker can manipulate the saved_avatar parameter to alter another user's avatar without holding user-management privileges. The issue is categorized under [CWE-285] Improper Authorization. A public exploit has been disclosed, and the maintainer released version 2.9.3 with commit c143e145caa600947e70a240e87f2fed889149d3 to remediate the issue.

Critical Impact

Authenticated low-privileged users can modify another user's avatar via the media crop endpoint, bypassing object-level authorization normally enforced by the users controller.

Affected Products

• owen2345 Camaleon CMS versions up to and including 2.9.2
• Component: Media Crop Handler (app/controllers/camaleon_cms/admin/media_controller.rb)
• Fixed in: Camaleon CMS 2.9.3

Discovery Timeline

• 2026-09-29 - CVE-2026-102261 published to NVD
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102261

Vulnerability Analysis

The vulnerability exists in the crop action of the Camaleon CMS admin media controller. The endpoint accepts a saved_avatar parameter that identifies which user's avatar the cropped image should replace. Prior to the patch, the controller performed the image upload and crop operation without verifying whether the caller was authorized to modify avatars belonging to other users. As a result, any authenticated user with baseline media permissions could target another user's identifier and overwrite their avatar image.

The defect is an object-level authorization failure. The UsersController#update action already enforces the :manage, :users capability for identity-related changes, but the media crop path shared no such check. This inconsistency created a lateral write primitive on the users resource through a media endpoint.

Root Cause

The root cause is missing authorization on a state-changing branch of the crop handler. The controller trusted the saved_avatar request parameter to identify the target user and performed the write without confirming that the current user either owned the target identifier or held user-management rights. This maps to [CWE-285] Improper Authorization.

Attack Vector

Exploitation requires network access to the admin media crop endpoint and a valid low-privileged authenticated session that can reach the media controller. The attacker submits a crop request with saved_avatar set to the numeric identifier of a victim user. The server processes the upload and replaces the victim's avatar with attacker-controlled image data. No user interaction from the victim is required.

           return render(plain: helpers.sanitize(url_error))
         end
 
+        # Security (object-level authorization): setting another user's avatar is a user-management
+        # write, so gate a non-self saved_avatar target on :manage, :users -- the same capability
+        # UsersController#update already requires. Decide from the parameter, before resolving the
+        # target (so a denied caller cannot use the response as a same-site existence oracle) and
+        # before the upload/crop (so no file work happens on a denied request). A caller may always
+        # set their own avatar with the media permission the endpoint already requires.
+        if params[:saved_avatar].present? && params[:saved_avatar].to_s != cama_current_user.id.to_s
+          authorize! :manage, :users
+        end
+
         tmp = cama_tmp_upload(cp_img_path, formats: params[:formats], name: params[:name])
         return render(plain: helpers.sanitize(tmp[:error])) if tmp[:error].present?

Source: GitHub commit c143e145. The patch inserts an authorize! :manage, :users check when saved_avatar targets an identifier different from the current user, and evaluates it before any file work to avoid producing an existence oracle.

Detection Methods for CVE-2026-102261

Indicators of Compromise

• POST requests to the admin media crop endpoint containing a saved_avatar parameter whose value does not match the authenticated session's user identifier.
• Unexpected changes to user avatar image files or database records for accounts the requester does not own.
• Repeated crop requests iterating through sequential user identifiers, suggesting enumeration.

Detection Strategies

• Enable request logging for the Camaleon CMS admin media controller and compare saved_avatar values against the authenticated user identifier in application logs.
• Add server-side audit events on avatar updates that record both the target user and the acting user for later correlation.
• Alert on admin media endpoint traffic originating from accounts that do not normally interact with user profile management.

Monitoring Recommendations

• Track outbound web server logs for HTTP requests to admin/media routes with high frequency from a single low-privileged session.
• Correlate file system writes under avatar storage paths with the identity of the requesting session to surface mismatches.
• Baseline normal avatar update volume per role and alert on deviations that could indicate mass avatar tampering.

How to Mitigate CVE-2026-102261

Immediate Actions Required

• Upgrade Camaleon CMS to version 2.9.3 or later, which contains commit c143e145caa600947e70a240e87f2fed889149d3.
• Audit recent avatar changes and restore any avatars modified by users who lack the :manage, :users capability.
• Review admin account inventories and remove unused or over-permissioned accounts that could reach the admin media controller.

Patch Information

The fix is available in the Camaleon CMS 2.9.3 release and the corresponding security commit c143e145. The patch enforces authorize! :manage, :users when the saved_avatar parameter references a user other than the caller, before performing any upload or crop work. Additional advisory context is available in the VulDB entry for CVE-2026-102261.

Workarounds

• If patching cannot be performed immediately, restrict access to the admin media controller at the web server or reverse proxy level to only accounts that hold user-management rights.
• Apply a local backport of the authorization check shown in the upstream patch to app/controllers/camaleon_cms/admin/media_controller.rb.
• Disable or gate the avatar cropping feature for non-administrative roles until the upgrade is deployed.

# Upgrade Camaleon CMS via Bundler
bundle update camaleon_cms --conservative
# Verify installed version is 2.9.3 or later
bundle info camaleon_cms | grep -i version