CVE-2026-102261CWE-285CWE-639

CVE-2026-102261

Medium · published September 29, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00244 · 14.7th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-29T09:16Z
References (7)
https://github.com/owen2345/camaleon-cms/commit/c143e145caa600947e70a240e87f2fed889149d3 · [email protected]https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3 · [email protected]https://vuldb.com/cve/CVE-2026-102261 · [email protected]https://vuldb.com/submit/934944 · [email protected]https://vuldb.com/vuln/411164 · [email protected]https://vuldb.com/vuln/411164/cti · [email protected]https://vuldb.com/submit/934944 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 29 SEP 04:00Z
    owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization
    cvelistv5