CVE-2026-66748

The CVSS 8.8 on this Camaleon CMS vulnerability warrants closer scrutiny before prioritization. While the score reflects a valid RCE via `instance_eval` in an ERB view, the actual exploitation surface is narrower than the rating suggests. The attack requires two gates: authentication and specifically the `custom_fields manage` permission. This isn't a low-privilege vector — field management implies content structure control, typically reserved for trusted admins or developers. However, examine your actual role assignments before assuming this is a non-issue. In practice, content teams often receive field configuration access for dynamic dropdowns and computed fields. Map your role-permission matrix to determine whether `custom_fields manage` is admin-exclusive or granted more broadly to content editors. The technical mechanism matters for defense: execution occurs within the view rendering object context via `instance_eval`, not as a system-level command. This constrains lateral movement compared to direct `system()` calls from a controller, though attackers have historically pivoted from Rails process context to persistence via cron jobs, SSH keys, or asset-path webshells. Treat this as full RCE until proven otherwise in your environment. The EPSS of 0.00805 likely underestimates risk if Camaleon CMS serves a concentrated user base (notably Latin American government and educational portals). Targeted campaigns against this ecosystem may already have valid admin credentials from prior phishing, bypassing the permission gate entirely. For defenders: verify which versions you run (2.1.1 through 2.9.1 are affected), audit who has custom_fields manage permission, and prioritize patching on externally-facing instances. The broad version span suggests years of latent exposure — assume this has been present in production longer than the CVE record indicates.

Reviewed through automated stages and approved by a human before publication.