CVE-2026-56720: CamaleonCMS Information Disclosure Flaw

CVE-2026-56720 Overview

CVE-2026-56720 is a missing authorization vulnerability [CWE-862] in CamaleonCMS version 2.9.2 and earlier. The flaw resides in the admin users controller, where the profile action is excluded from the role validation filter without a compensating ownership check. Any authenticated user can supply an arbitrary user_id parameter to a GET request against the admin profile endpoint and retrieve another user's profile data. Because user IDs are enumerable sequential integers, attackers can iterate through the ID space to disclose profile information for any account, including administrators.

Critical Impact
Any authenticated CamaleonCMS user can read the profile data of any other user, including administrators, by supplying an enumerable numeric user_id parameter to the admin profile endpoint.

Affected Products

CamaleonCMS version 2.9.2
CamaleonCMS versions earlier than 2.9.2
Ruby on Rails deployments embedding the affected camaleon_cms gem

Discovery Timeline

2026-08-11 - CVE-2026-56720 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-56720

Vulnerability Analysis

The vulnerability is a broken access control issue in the profile action of CamaleonCms::Admin::UsersController. The action retrieves a user record based on the user_id request parameter and renders that user's profile edit view. Role-based authorization normally enforced through a manage :users capability check is not applied to the profile action, and no alternative ownership check confirms that the requested user_id matches the currently authenticated user. This gap converts an intended self-service profile endpoint into an authenticated read primitive over the entire user table.

Exploitation requires only a valid low-privileged session. Because CamaleonCMS assigns sequential integer identifiers, an attacker can enumerate user_id=1, user_id=2, and so on to systematically harvest profile details for every account in the tenant, including administrator accounts. Disclosed fields can include email addresses, usernames, and other profile attributes stored on the user record, which support downstream credential attacks, phishing, and account takeover attempts.

Root Cause

The root cause is a missing authorization control [CWE-862]. The profile action was placed on the exclusion list for the CanCan authorization filter without adding an equivalent ownership check inside the action body. The controller trusts the client-supplied user_id parameter and calls current_site.the_user(user_id.to_i) to load an arbitrary user before invoking edit.

Attack Vector

Exploitation is performed over the network by any authenticated user with access to the admin interface. The attacker issues a GET request to the admin profile endpoint and appends a user_id query parameter set to the target user's numeric identifier. No user interaction, elevated privileges, or additional preconditions are required beyond an authenticated session.

ruby

# Vulnerable code path and applied patch
# app/controllers/camaleon_cms/admin/users_controller.rb
         add_breadcrumb I18n.t('camaleon_cms.admin.users.profile')
         user_id = params[:user_id]
         @user = user_id.present? ? current_site.the_user(user_id.to_i).object : cama_current_user.object
+        authorize! :manage, :users if user_id.present? && @user.id != cama_current_user.id
         edit
       end

Source: GitHub Commit ae10da7. The added line invokes authorize! :manage, :users whenever a user_id is supplied and it does not match the current user's ID, restoring the ownership check.

Detection Methods for CVE-2026-56720

Indicators of Compromise

GET requests to the admin profile route containing a user_id query parameter whose value does not match the requesting session's user ID.
Sequential enumeration patterns from a single session, such as repeated profile requests with incrementing user_id values (1, 2, 3...).
Non-administrator sessions accessing profile records associated with administrator accounts.

Detection Strategies

Enable Rails request logging for the CamaleonCms::Admin::UsersController#profile action and alert on requests where params[:user_id] differs from the session's authenticated user ID.
Correlate web access logs with authenticated session identifiers to identify accounts issuing rapid, monotonically increasing user_id values against the profile endpoint.
Baseline normal profile-endpoint traffic per user and flag deviations that suggest programmatic enumeration.

Monitoring Recommendations

Forward CamaleonCMS application and web-server logs to a centralized log platform and retain them long enough to investigate account enumeration campaigns.
Track authentication anomalies for administrator accounts after any suspected enumeration, since disclosed emails and usernames enable targeted phishing and credential stuffing.
Monitor for outbound use of harvested administrator email addresses in inbound phishing waves or password-reset abuse.

How to Mitigate CVE-2026-56720

Immediate Actions Required

Upgrade the camaleon_cms gem to the version that includes commit ae10da7cfce902a8552927c57b0a562fb1676040, which adds the ownership check on the profile action.
Audit application and web-server logs for prior requests to the admin profile endpoint containing mismatched user_id parameters and treat matches as potential information disclosure events.
Rotate credentials and review multi-factor authentication enrollment for administrator accounts whose profile data may have been exposed.

Patch Information

The fix is delivered in GitHub Pull Request #1197 and committed as ae10da7. The patch adds authorize! :manage, :users if user_id.present? && @user.id != cama_current_user.id to the profile action, so any request that targets a different user's ID triggers the standard authorization check. Additional context is available in the VulnCheck advisory and the CamaleonCMS repository.

Workarounds

If patching is not immediately feasible, apply the one-line ownership check from commit ae10da7 as a local patch to app/controllers/camaleon_cms/admin/users_controller.rb.
Restrict access to the CamaleonCMS admin interface using network-level controls such as IP allow-listing or a VPN to reduce the population of authenticated users able to reach the vulnerable endpoint.
Deploy a web application firewall rule that blocks requests to the admin profile endpoint when the user_id parameter does not match the session user identifier.

bash

# Update the camaleon_cms gem to a patched release
bundle update camaleon_cms

# Verify the installed version includes the fix commit
bundle info camaleon_cms

# Restart the Rails application server to load the patched controller
bundle exec rails restart