CVE-2026-120430
Medium · 5.4CVSS
5.4
EPSS
0.3%
Published
Nov 2, 2026
CISA due date
—
The record
Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121734 ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows… CWE-639
- CVE-2026-121732 RosarioSIS before 12.9 contains an improper authorization vulnerability that allows… CWE-639
- CVE-2026-121582 A vulnerability has been found in Umami up to 3.4.1. CWE-639
- CVE-2026-116669 Tanium addressed an improper access controls vulnerability in Discover. CWE-639
- CVE-2026-121631 Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the… CWE-639
- CVE-2026-115292 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can… CWE-639
- CVE-2026-115295 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to… CWE-639
- CVE-2026-121560 LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that… CWE-639