CVE-2026-56720 owen2345 CVE debrief

Who should care

Administrators and users of CamaleonCMS version 2.9.2 and earlier should be aware of this vulnerability and take necessary actions to protect their systems. Affected operators should review user ID enumeration, profile access controls, and compensating mitigations. Vulnerability management and security teams should prioritize verification and remediation efforts.

Technical summary

CVE-2026-56720 is a missing authorization vulnerability in CamaleonCMS version 2.9.2 and earlier. The vulnerability exists in the admin users controller, allowing any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can exploit this by sending a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators. This could allow attackers to disclose profile information of any user.

Defensive priority

Medium-priority defensive actions are recommended due to the MEDIUM CVSS severity score of 5.3 for CVE-2026-56720, which could allow attackers to disclose profile information of any user.

Recommended defensive actions

• Verify and apply the vendor's remediation for CamaleonCMS version 2.9.2 and earlier.
• Restrict access to the admin profile endpoint to authenticated users with proper authorization.
• Monitor for and track any attempts to enumerate user IDs and access profile data.
• Consider implementing compensating controls, such as IP restrictions or additional authentication mechanisms.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence is based on official CVE and NVD records, as well as limited source references from [email protected]. Further verification is recommended. The vulnerability exists in CamaleonCMS version 2.9.2 and earlier, allowing any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. To verify, defenders should review user ID enumeration, profile access controls, and compensating mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.