Description
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| camaleon_cms | camaleon_cms | 0.1.7 – < unspecified, unspecified – ≤ 2.6.0 | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | camaleon_cms | >= 0.1.7, < 2.6.0.1 | 2.6.0.1 | GHSA-438x-2p9v-g8h9 |