In CamaleonCMS, the updated_ajax endpoint contains an IDOR that allows a low-privileged user to overwrite arbitrary user credentials — including administrator accounts — by manipulating the user_id parameter independently of the id parameter the authorization layer checks. This isn't a single coding error; it's a structural disconnect between the before_filter that validates params[:id] and the action body that trusts params[:user_id] as the authoritative identifier. The authorization check and business logic were never co-designed — they operate on different parameter contracts, allowing the filter to pass while the action executes the escalation.
This pattern almost certainly exists elsewhere in the codebase. Authorization and CRUD operations in Rails applications frequently evolve separately, and parameter naming inconsistencies between before_filters and action bodies are a known failure mode. If CamaleonCMS has not audited its entire UsersController and analogous controllers for similar parameter mismatches, additional IDOR vulnerabilities likely exist — particularly in role_assignment, permission modification, and profile update endpoints where similar naming patterns probably appear.
Audit specifically for three conditions: controllers with before_filters that validate one identifier (commonly :id) while action bodies consume a different identifier (commonly :user_id, :role_id, or :resource_id); AJAX endpoints and legacy API handlers that may have been skipped during security hardening cycles; and endpoints handling high-severity operations like theme upload, plugin installation, or credential modification where parameter confusion would have the greatest impact.
The downstream severity exceeds what CVSS 8.8 captures. Achieving admin access in a CMS typically provides server-side code execution through theme or plugin upload features. Treat this as a potential unauthenticated RCE chain, not merely a credential overwrite vulnerability, and prioritize patching accordingly.