CVE-2026-67616: Camaleon CMS Auth Bypass Vulnerability

CVE-2026-67616 Overview

CVE-2026-67616 is a missing authorization vulnerability in Camaleon CMS through version 2.9.2. The flaw resides in the admin drafts endpoint and allows any authenticated low-privileged user to bypass role and permission checks. Attackers with valid session credentials can send requests to the drafts endpoint and create unauthorized draft posts. These drafts subsequently appear in the administrative drafts queue, injecting attacker-controlled content into workflows that assume authorized authorship. The vulnerability is tracked as CWE-862 Missing Authorization and is fixed in commit 88ab703.

Critical Impact
Authenticated low-privileged users can create draft posts in the administrative queue by bypassing role and permission enforcement.

Affected Products

Camaleon CMS versions through 2.9.2
Deployments running the admin/posts/drafts_controller.rb prior to commit 88ab703
Ruby on Rails applications embedding vulnerable Camaleon CMS releases

Discovery Timeline

2026-08-03 - CVE-2026-67616 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67616

Vulnerability Analysis

The vulnerability exists in the create action of CamaleonCms::Admin::Posts::DraftsController. The controller accepted authenticated requests without invoking CanCan authorization checks against the target post type or draft object. Any user with a valid session, regardless of role, could therefore submit draft data and have it persisted through @post_draft.save. The saved draft entered the administrative drafts queue where privileged users review and publish content, enabling content injection into a trusted workflow.

Root Cause

The controller relied on session authentication alone and omitted the authorize! calls that enforce role-based permissions across the rest of the admin surface. Draft lookup also queried CamaleonCms::Post.drafts globally rather than scoping to @post_type.posts.drafts, which allowed cross-post-type access. No verification tied the operation to the caller's cama_current_user privileges before persistence.

Attack Vector

An authenticated user with the lowest available role sends a crafted POST request to the drafts endpoint containing post_data fields. Because no authorization check runs, the request reaches @post_type.posts.new(@post_data) and the resulting draft is saved with validate: false. The draft appears in the admin queue, where reviewers may act on it under the assumption it originated from an authorized author.

ruby

 def create
   if params[:post_id].present?
-    @post_draft = CamaleonCms::Post.drafts.where(post_parent: params[:post_id]).first
+    @post_draft = @post_type.posts.drafts.where(post_parent: params[:post_id]).first
     if @post_draft.present?
+      authorize! :update, @post_draft
       @post_draft.set_option('draft_status', @post_draft.status)
       @post_draft.attributes = @post_data
     end
   end
-  @post_draft = @post_type.posts.new(@post_data) if @post_draft.blank?
+  if @post_draft.blank?
+    authorize! :create_post, @post_type
+    @post_draft = @post_type.posts.new(@post_data)
+    @post_draft.user_id = cama_current_user.id
+  end
   r = { post: @post_draft, post_type: @post_type }
   hooks_run('create_post_draft', r)
   if @post_draft.save(validate: false)

Source: Camaleon CMS security patch commit 88ab703. The patch adds authorize! :update and authorize! :create_post guards, scopes draft lookups to @post_type.posts, and assigns user_id to the current user.

Detection Methods for CVE-2026-67616

Indicators of Compromise

Draft posts in the administrative queue attributed to accounts that lack post-creation roles.
POST requests to the Camaleon CMS drafts endpoint originating from low-privileged session cookies.
Unexpected create_post_draft hook executions in application logs tied to non-editor users.

Detection Strategies

Correlate Rails request logs with user role metadata to flag draft creations by users lacking create_post capability.
Audit the posts table for draft rows whose user_id maps to accounts without publishing privileges.
Deploy web application firewall rules to log requests to the admin/posts/*/drafts route and alert on non-privileged principals.

Monitoring Recommendations

Enable verbose logging on CamaleonCms::Admin::Posts::DraftsController#create and forward events to a centralized log store.
Track spikes in draft creation volume and new draft authors to surface bulk-injection attempts.
Review administrative dashboards periodically for drafts containing suspicious payloads or external links.

How to Mitigate CVE-2026-67616

Immediate Actions Required

Upgrade Camaleon CMS to the patched build that includes commit 88ab703 from pull request #1196.
Audit existing draft entries and remove any authored by accounts without legitimate post-creation rights.
Rotate session tokens and review recent low-privileged account activity for signs of abuse.

Patch Information

The fix is delivered in commit 88ab703, which introduces authorize! :update, @post_draft and authorize! :create_post, @post_type calls, scopes draft queries to the current post type, and binds new drafts to cama_current_user.id. Additional context is available in the VulnCheck advisory.

Workarounds

Restrict access to the admin/posts/*/drafts route at the reverse proxy or WAF layer so only editor-role users can reach it.
Add a temporary before_action filter in DraftsController invoking authorize! :create_post, @post_type until the upgrade is applied.
Disable self-service account registration to limit the pool of low-privileged users capable of exploiting the flaw.

bash

# Nginx location block restricting drafts endpoint to internal editors
location ~ ^/admin/posts/[^/]+/drafts {
    allow 10.0.0.0/24;   # editor subnet
    deny all;
    proxy_pass http://camaleon_upstream;
}