CyberRota Analysis
AI-GeneratedCamaleonCMS versions 2.9.2 and earlier are vulnerable due to a missing authorization check in the admin users controller, allowing any authenticated user to access the profile data of other users by manipulating the user ID parameter in a GET request. This vulnerability can lead to unauthorized disclosure of sensitive user information, including that of administrators. Organizations using affected versions should prioritize patching to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators, due to the profile action being excluded from the role validation filter with no compensating ownership check.