Camaleon CMS: Missing authorization in MediaController (CVE-2026-120429)

Camaleon CMS versions before 2.9.2 contain a missing authorization vulnerability within the Admin::MediaController. This flaw allows authenticated users with low privileges to bypass role-based permission checks. An attacker can exploit this to upload arbitrary files, access private media files via download_private_file, and manipulate other users' avatars by calling the crop function with saved_avatar.

Impact

Successful exploitation allows low-privileged users to read sensitive private media files, perform unauthorized file uploads, and perform account-level modification by altering user avatars.

Recommendation

• Upgrade Camaleon CMS to version 2.9.2 or later to apply the authorization checks for media management.
• Audit administrative media logs for unexpected file uploads or avatar modifications performed by low-privileged user accounts.