CVE-2026-102261

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102261
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102261.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102261
Published
2026-09-29T04:00:13Z
Modified
2026-10-01T03:30:50Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization
Details

A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-285",
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102261.json"
}
References

Affected packages

Git / github.com/owen2345/camaleon-cms

Affected ranges

Type
GIT
Repo
https://github.com/owen2345/camaleon-cms
Events
Introduced
c3292fef7a84543a65584cab654a39b25bc7f523
Fixed
c143e145caa600947e70a240e87f2fed889149d3
Fixed
d4113a0edc3bac2e6b9f950dbf217237343cb327
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.9.0"
        },
        {
            "last_affected":  "2.9.0"
        },
        {
            "introduced":  "2.9.1"
        },
        {
            "last_affected":  "2.9.1"
        },
        {
            "introduced":  "2.9.2"
        },
        {
            "last_affected":  "2.9.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.9.0
2.9.1
2.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102261.json"