CVE-2026-73326: CamaleonCMS Auth Bypass Vulnerability

CVE-2026-73326 Overview

CamaleonCMS contains a missing authorization vulnerability [CWE-862] that exposes four plugin-administration endpoints to any authenticated low-privileged user. The affected endpoints belong to the attack, front_cache, cama_meta_tag, and cama_contact_form plugins. Attackers can manipulate plugin configuration parameters at runtime without administrator-level authorization. This allows them to alter cached page behavior, modify public meta-tag output, and reconfigure contact forms. When chained with stored cross-site scripting through the contact form's before_html field, the flaw enables account takeover.

Critical Impact
Any authenticated low-privileged CamaleonCMS user can modify plugin settings and achieve administrator account takeover by chaining with stored XSS in the contact form.

Affected Products

CamaleonCMS (attack plugin administration endpoint)
CamaleonCMS (front_cache and cama_meta_tag plugin administration endpoints)
CamaleonCMS (cama_contact_form plugin administration endpoint)

Discovery Timeline

2026-08-12 - CVE-2026-73326 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73326

Vulnerability Analysis

CamaleonCMS ships with a plugin architecture where administrators configure runtime behavior through dedicated administration endpoints. Four of these endpoints, belonging to the attack, front_cache, cama_meta_tag, and cama_contact_form plugins, do not enforce role-based authorization checks. Any user holding a valid session, regardless of privilege level, can invoke them to read or modify plugin settings.

The impact scales with plugin functionality. Modifying front_cache alters how cached pages are served to the public. Changing cama_meta_tag settings rewrites publicly rendered meta content. Reconfiguring cama_contact_form lets an attacker inject arbitrary HTML into the form's before_html field. Because this HTML renders in the browser context of visitors, including administrators, the chain elevates a low-privileged user to administrator through stored cross-site scripting.

Root Cause

The root cause is a missing authorization control [CWE-862] on the affected plugin-administration controllers. The endpoints authenticate the session but omit the administrator-role check performed elsewhere in the application. Access control is enforced inconsistently across the plugin surface.

Attack Vector

Exploitation requires network access and a low-privileged authenticated session. The attacker sends HTTP requests directly to the exposed plugin-administration endpoints and supplies configuration parameters. No user interaction is required from the victim to write the malicious configuration. Administrator interaction is required only when the injected before_html payload fires in the administrator's browser to complete the account takeover chain. Refer to the VulnCheck Advisory on Camaleon CMS and the Enrik-M Blog Post on Vulnerabilities for endpoint-level detail.

Detection Methods for CVE-2026-73326

Indicators of Compromise

Unexpected changes to plugin configuration records for attack, front_cache, cama_meta_tag, or cama_contact_form.
Contact form before_html field containing <script>, onerror=, or other executable HTML.
Administrator sessions originating from IPs previously associated with low-privileged accounts shortly after plugin-setting changes.

Detection Strategies

Review web-server access logs for requests to the four plugin-administration endpoints originating from non-administrator user sessions.
Diff plugin configuration state against a known-good baseline and alert on drift.
Inspect rendered contact form pages for injected HTML or JavaScript in the before_html output.

Monitoring Recommendations

Alert on any HTTP POST or PUT to plugin-administration paths from accounts lacking the administrator role.
Monitor CamaleonCMS audit trails for plugin setting mutations correlated with recently created or low-privileged accounts.
Track new administrator logins that follow within a short window of plugin configuration changes.

How to Mitigate CVE-2026-73326

Immediate Actions Required

Restrict access to CamaleonCMS administration interfaces at the network layer until a patched version is deployed.
Audit all existing user accounts and remove low-privileged users that are not strictly required.
Review current attack, front_cache, cama_meta_tag, and cama_contact_form plugin settings for unauthorized modifications and revert as needed.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Monitor the Camaleon CMS GitHub Repository and the VulnCheck Advisory on Camaleon CMS for a fix release and upgrade guidance.

Workarounds

Disable the attack, front_cache, cama_meta_tag, and cama_contact_form plugins if they are not required for site operation.
Add a reverse-proxy or web application firewall rule that restricts the plugin-administration paths to administrator source IPs.
Enforce output encoding on the contact form before_html field or block requests that include HTML tags in that parameter.

bash

# Example nginx rule restricting plugin-administration paths to a trusted admin subnet
location ~* ^/admin/plugins/(attack|front_cache|cama_meta_tag|cama_contact_form) {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://camaleon_backend;
}