CVE-2026-73329

The CVSS 8.7 rating for CVE-2026-73329 masks something more interesting: a stored XSS in CamaleonCMS's draft workflow where an authenticated user can inject HTML into draft titles that executes when an administrator views the drafts listing. No additional victim interaction required — the admin doing their normal review work triggers the payload. That's a high-reliability attack path. But the EPSS of 0.00229 tells a different story. The gap isn't a scoring error — it's a symptom of something the security community systematically overlooks. Draft workflows in CMS platforms create what amounts to implicit trust zones: code regions where developers apply different security assumptions not because of explicit decisions, but because 'draft' connotes 'not yet public.' That psychological framing downgrades the threat model even for the same admin interface where published content gets properly escaped. The specific failure is a rendering-context mismatch. Draft submission accepts raw HTML while publish paths sanitize — this split happens invisibly in the interface contract, without explicit security architecture documentation specifying different rendering contexts for different features. When the published content pipeline got hardened, the draft path was already 'done' and off the security review list. That's not lazy oversight; it's entropy in forgotten code regions that never got revisited as the rest of the application evolved. The blast radius matters more than the EPSS suggests. Admin session compromise in CMS platforms almost universally gates plugin installation, theme deployment, and often database credentials. Stored XSS in drafts isn't a niche finding — it's a wedge into infrastructure-wide compromise. The EPSS reflects opportunistic scanning, not sophisticated actors who target high-value admin sessions specifically. The question isn't whether CVSS 8.7 is inflated for a niche CMS. For organizations running CamaleonCMS, this is absolutely an 8.7 — admin compromise is catastrophic regardless of attacker interest. The real question is whether your security review process includes internal workflows that feel 'less exposed.' Draft paths, preview modes, and admin-only render contexts are the forgotten attack surface, and they're probably not getting the same sanitization rigor as published content. Check your CMS's draft rendering logic specifically — not as a low-priority task, but as a known blind spot that this CVE exemplifies.

Reviewed through automated stages and approved by a human before publication.