https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-12T07:43:19.600010+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-120429 fkie_cve-2026-120429 2026-11-12T07:43:19.601171+00:00

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.

 https://db.gcve.eu/vuln/ghsa-w2c5-xppr-2hh6 GHSA-w2c5-xppr-2hh6 2026-11-12T07:43:19.601242+00:00

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.