Is CVE-2026-10715 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10715 being exploited in the wild.

How severe is CVE-2026-10715?

Informational severity, with a CVSS score of 5.1, published 12 June 2026.

Which products and versions are affected?

Camaleon CMS Camaleon CMS 2.9.2.

Is there a fix for CVE-2026-10715?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10715 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-10715?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10715: Camaleon CMS improper authorization in draft autosave endpoint

CVE-2026-10715 · Severity: info · CVSS 5.1 · Published 2026-06-12

Camaleon CMS, a content management system built on Ruby on Rails, contains a security flaw in its administrative draft saving feature. An authorized user with low-level permissions can exploit this to overwrite the saved drafts of other users, including those belonging to administrators. This could lead to the loss of original content or the unauthorized modification of pending website updates.

Quick answers

Is CVE-2026-10715 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10715 being exploited in the wild.
How severe is CVE-2026-10715?: Informational severity, with a CVSS score of 5.1, published 12 June 2026.
Which products and versions are affected?: Camaleon CMS Camaleon CMS 2.9.2.
Is there a fix for CVE-2026-10715?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10715 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-10715?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability (CWE-862) exists in Camaleon CMS 2.9.2 within the administrator draft autosave endpoint. The application fails to validate if the authenticated user has the rights to modify a specific post when sending a request to the POST /admin/post_type/<POST_TYPE_ID>/drafts endpoint. By supplying an arbitrary post_id, a low-privileged authenticated attacker can overwrite the draft content associated with any other user's post. This attack requires network access and valid low-privileged credentials.

Affected products

Camaleon CMS Camaleon CMS 2.9.2

Timeline

2026-06-12: disclosed
2026-06-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.