Answer in brief
CVE-2026-120430 records a Medium severity (CVSS 5.3) vulnerability in Camaleon CMS before 2.9.2 IDOR via Admin::CategoriesController. The current sources do not mark it as known exploited. The current feed maps owen2345/Camaleon CMS (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps owen2345/Camaleon CMS (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| owen2345/Camaleon CMSgeneric | >=0 <2.9.2 | 2.9.2 |
Published upstream
Nov 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 2, 2026
Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.
Quoted source text, attributed separately from HOL analysis.