CVE-2026-73326 is a missing authorization flaw in CamaleonCMS. Any authenticated low privilege user can reach four unprotected plugin administration endpoints and change plugin settings. The record scores it 7.6, High. VulnCheck lists versions up to 2.9.1 as affected, and we could not confirm a fixed version.
What's affected
VulnCheck lists CamaleonCMS version 2.9.1 and earlier as affected. The record gives no versions. We did not find a fixed release in the sources we read, so check the project repository and its release notes before assuming a newer version is safe. The researcher write up that the record links was not readable in the form we fetched it.
The record describes four plugin administration endpoints that lack administrator level authorization. They belong to the attack, front_cache, cama_meta_tag and cama_contact_form plugins. A low privilege user who is logged in can change plugin configuration at runtime. The record lists three effects, which are changes to cached page behavior, changes to the public meta tag output, and reconfiguration of contact forms. It says that chaining with a stored cross-site scripting flaw in the contact form can lead to account takeover. That companion flaw is covered in CVE-2026-73332.
The weakness class is CWE-862, missing authorization.
How to check if you're exposed
Find out whether you run CamaleonCMS and which version.
bundle list | grep camaleon_cms
Run this in your application directory, or read the version from Gemfile.lock. If the gem is at 2.9.1 or lower, you are in the range VulnCheck lists. Then count how many low privilege accounts exist. Any registered user, such as a contributor or a member who signed up, is a possible source of this attack. If your site does not allow public sign up and all users are trusted, your exposure is smaller. The free in-browser scan at gold.safeguard.sh/scan accepts a manifest and lists known CVEs for the packages it finds.
What to do now
- Check the CamaleonCMS repository for a fixed release and upgrade when one is confirmed.
- Until then, remove low privilege accounts that are not needed and disable open registration.
- Block access to the plugin administration routes for non-admin users at your reverse proxy or application firewall, if you can.
- Review the configuration of the four named plugins for changes you did not make.
- Check contact forms for unexpected content in their before_html field.
- Apply the controls for CVE-2026-73332 at the same time, since the two chain.
Why it matters
Missing authorization is easy to introduce and hard to see. A route works for the administrator in testing, so nobody checks what happens for a regular user. Frameworks usually need an explicit check on each route, and a plugin that adds routes can forget it.
On rating, the record scores this 7.6 High under CVSS 3.1. VulnCheck lists it as high at 7.2 under CVSS 4.0. The two agree. The real risk grows when the flaw chains with a stored script injection, where a low privilege user can place script in a form that an administrator later loads. No source we read says the flaw has been exploited in the wild, and the CVE is not on the CISA KEV list.
Quick check
Which accounts can use CVE-2026-73326?
Any authenticated low privilege user, per the record.
Is there a confirmed fix?
We could not confirm one. VulnCheck lists 2.9.1 and earlier as affected. Check the project repository.
Sources
Last reviewed: 18 October 2026.
