ADVISORIES

• CVE-2025-2304 (NVD)
• GHSA-rp28-mvq3-wf8j

GEM

camaleon_cms

PATCHED VERSIONS

• >= 2.9.1

DESCRIPTION

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS

When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.

RELATED

• https://nvd.nist.gov/vuln/detail/CVE-2025-2304
• https://www.tenable.com/security/research/tra-2025-09
• https://github.com/owen2345/camaleon-cms/pull/1109
• https://github.com/owen2345/camaleon-cms/commit/179fd6b1ecf258d3e214aebfa87ac4a322ea4db4
• https://github.com/owen2345/camaleon-cms/releases/tag/2.9.1
• https://github.com/advisories/GHSA-rp28-mvq3-wf8j