CVE-2026-56721: CamaleonCMS Privilege Escalation Flaw

CVE-2026-56721 Overview

CVE-2026-56721 is a privilege escalation vulnerability in CamaleonCMS version 2.9.2 and earlier. The flaw is an Insecure Direct Object Reference (IDOR) [CWE-639] in the UsersController#updated_ajax action. A parameter confusion issue between the authorization filter and the action body allows an authenticated low-privileged attacker to overwrite any user's credentials. By sending a PATCH request with params[:id] set to the attacker's own user ID and params[:user_id] set to a victim's ID, the attacker bypasses self-authorization checks while mutating another account. Overwriting an administrator password yields full site takeover.

Critical Impact
An authenticated low-privileged user can reset the administrator password and take over the entire CamaleonCMS site.

Affected Products

CamaleonCMS version 2.9.2
CamaleonCMS earlier than 2.9.2
Ruby on Rails applications embedding vulnerable CamaleonCMS releases

Discovery Timeline

2026-08-11 - CVE CVE-2026-56721 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-56721

Vulnerability Analysis

The vulnerability resides in the updated_ajax action of app/controllers/camaleon_cms/admin/users_controller.rb. The controller's authorization filter validates that the requester owns the account referenced by params[:id]. The action body, however, loads the target user from a different parameter: params[:user_id]. This mismatch is the root of the parameter confusion.

An attacker submits params[:id] matching their own account to satisfy the self-check, then submits params[:user_id] pointing to a victim account. The controller then loads and updates the victim, including the password and password_confirmation attributes. Because CamaleonCMS uses this endpoint for profile password changes, the attacker can set arbitrary credentials on any account, including administrators.

Root Cause

The root cause is inconsistent identifier resolution between the authorization layer and the resource-loading layer. Two different request parameters address the same conceptual entity, and the controller trusts each independently. This is a classic Insecure Direct Object Reference [CWE-639] combined with a broken access control pattern.

Attack Vector

Exploitation requires network access to the CamaleonCMS admin interface and a valid low-privileged authenticated session. The attacker issues a single PATCH request to the updated_ajax endpoint containing both id (self) and user_id (victim) parameters, along with a chosen password and password_confirmation. No user interaction on the victim side is required.

ruby

# update some ajax requests from profile or user form
def updated_ajax
-  @user = current_site.users.find(params[:user_id])
+  @user = current_site.users.find(user_id_param)
  update_session = current_user_is?(@user)
  attrs = params.require(:password).permit(%i[password password_confirmation])
  @user.update(password: attrs.require(:password), password_confirmation: attrs.require(:password_confirmation))

Source: GitHub Commit for Camaleon CMS. The patch replaces the raw params[:user_id] lookup with a user_id_param helper that aligns the resource identifier with the authorized identifier.

Detection Methods for CVE-2026-56721

Indicators of Compromise

PATCH requests to /admin/users/updated_ajax (or equivalent routed path) containing both id and user_id parameters with different values.
Unexpected password change events on administrator accounts originating from low-privileged user sessions.
Successful admin logins from IP addresses or user agents historically associated with non-admin accounts.

Detection Strategies

Inspect Rails application logs for UsersController#updated_ajax invocations where the user_id parameter does not match the authenticated user's ID.
Correlate password-update audit events with the initiating session's role to flag privilege mismatches.
Add web application firewall rules that alert when the updated_ajax endpoint receives conflicting id and user_id values.

Monitoring Recommendations

Monitor administrator account credential changes and require out-of-band verification for high-privilege updates.
Track authentication anomalies such as a user logging in immediately after another user modified their record.
Retain and centralize CamaleonCMS access logs for post-incident analysis of controller parameters.

How to Mitigate CVE-2026-56721

Immediate Actions Required

Upgrade CamaleonCMS to the release containing commit 26345034523a505cb01615509b7f0a665e89ae3e or later.
Rotate credentials for all administrator and privileged accounts after patching.
Audit user records for unauthorized password changes since the vulnerable version was deployed.

Patch Information

The fix is merged via GitHub Pull Request #1185 and applied in this commit. The patch introduces a user_id_param helper so the controller loads the same user record the authorization filter validates. Additional context is available in the VulnCheck Security Advisory on Camaleon CMS.

Workarounds

Restrict access to the CamaleonCMS admin interface to trusted networks or VPN clients until the patch is deployed.
Add a request filter that rejects updated_ajax calls when params[:id] and params[:user_id] are both present or do not match the authenticated user.
Temporarily disable the AJAX profile update endpoint at the routing layer if patching is not immediately feasible.

bash

# Update the CamaleonCMS gem to the patched release
bundle update camaleon_cms

# Verify the installed version excludes 2.9.2 and earlier
bundle info camaleon_cms | grep version