Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController

Summary

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.

Remediation

1. Inventory every owen2345 Camaleon CMS deployment, including staging.
2. Upgrade owen2345 Camaleon CMS to 2.9.2.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/owen2345/camaleon-cms/commit/7fe4fa0bf99256dfe32b5f674baf4f771606549e
• Patchhttps://github.com/owen2345/camaleon-cms/pull/1147
• Advisoryhttps://www.vulncheck.com/advisories/camaleon-cms-before-2.9.2-missing-authorization-via-admin-mediacontroller
• Referencehttps://github.com/owen2345/camaleon-cms/blob/2.9.1/app/controllers/camaleon_cms/admin/media_controller.rb
• Referencehttps://github.com/owen2345/camaleon-cms/releases/tag/2.9.2