Dashboard / CVE-2026-120430

CVE-2026-120430

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-11-02 Modified: 2026-11-05 First seen: 2026-11-02 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: None
VI: Low
VA: Low

Description

Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
owen2345 Camaleon CMS 0 < 2.9.2
owen2345 Camaleon CMS 0 < 2.9.2

References & Advisories (5)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.28%
Raw Score 0.002780
Percentile 20.5%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00278
2026-11-12
0.00278
2026-11-10
0.00278
2026-11-09
0.00278
2026-11-08
0.00278
2026-11-07
0.00278
2026-11-06
0.00278
2026-11-05
0.00278
2026-11-04
0.00278
2026-11-03
0.00278

Intelligence Sources

mitre ref →
nvd ref →

External Links