Privilege Escalation via IDOR in CamaleonCMS

CamaleonCMS versions 2.9.2 and earlier contain a critical privilege escalation vulnerability (CVE-2026-56721) stemming from an Insecure Direct Object Reference (IDOR) flaw within the UsersController. The vulnerability resides in a parameter confusion discrepancy between the authorization filter, which checks the 'id' parameter, and the action body, which processes the 'user_id' parameter. An authenticated low-privileged attacker can exploit this by crafting a PATCH request to the 'update_ajax' endpoint. By setting the 'id' parameter to their own identifier to satisfy the authorization filter, and concurrently setting the 'user_id' parameter to an administrator or target user's identifier, the application logic incorrectly loads and mutates the victim's account. Successful exploitation allows for the modification of any user's credentials, facilitating a full site takeover. Defenders should prioritize patching or implementing request validation logic to ensure parameter consistency.

Attack Chain

1. Attacker gains authenticated access to the target application with a low-privileged account.
2. Attacker discovers the 'update_ajax' PATCH endpoint used for user profile management.
3. Attacker crafts a malicious HTTP PATCH request targeting the '/update_ajax' route.
4. Attacker includes their own user ID in the 'id' parameter to bypass the authorization filter.
5. Attacker includes the victim's (e.g., admin) user ID in the 'user_id' parameter within the request body.
6. The application performs the authorization check against the attacker's ID, which succeeds.
7. The application processes the request body, using the victim's ID to perform the update.
8. The victim's password or other sensitive account information is overwritten by the attacker, achieving account takeover.

Impact

Successful exploitation of CVE-2026-56721 allows an unprivileged attacker to escalate privileges to administrator status. This grants the attacker full control over the CamaleonCMS instance, potentially leading to unauthorized data exfiltration, system configuration changes, or the deployment of additional malicious persistence mechanisms. The impact is significant for organizations relying on CamaleonCMS for content management, as it provides a direct path to site-wide administrative compromise.

Recommendation

• Update CamaleonCMS to the latest patched version immediately to remediate CVE-2026-56721.
• Deploy the provided Sigma rule to web server logs to monitor for unauthorized 'update_ajax' PATCH requests with mismatched 'id' and 'user_id' parameter combinations.
• Review web application access logs for repeated PATCH requests to 'update_ajax' originating from non-administrative accounts.