CVE-2025-2304 — Camaleon CMS Privilege Escalation

CVE-2025-2304

Camaleon CMS Privilege Escalation PUBLISHED

Description (CNA)

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.

Affected (CNA)

Vendor / product	Versions
owen2345 / camaleon-cms	unaffected 0 before 2.9.1

CWE

CWE-915

References

https://www.tenable.com/security/research/tra-2025-09
https://github.com/owen2345/camaleon-cms

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.