CVE-2026-116281
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In Kameleo up to 5.0.1.26, the ListProfiles function in client-engine-application/t.cs of the Profile Controller component leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses the issue.
Risk Assessment
A local attacker could access information they should not be authorized to see, potentially compromising data confidentiality on the user's machine.
Recommendation
Upgrade Kameleo to version 5.2.0. Upgrading the affected component is recommended.
Other vulnerabilities in Kameleo
See all- CVE-2026-116284Medium
A security vulnerability has been detected in Kameleo up to 5.3.1 affecting unknown code of the file /general/user-info of the Local API component. Such manipulation leads to information disclosure, and the attack may be performed remotely. The vendor did not respond to the disclosure.
- CVE-2026-116283Medium
A weakness has been identified in Kameleo up to 5.0.1.26 affecting an unknown part of the /profiles file of the Local API component. The manipulation causes information disclosure and the attack can be carried out remotely.
- CVE-2026-116282Medium
A security flaw has been discovered in Kameleo up to 5.3.1 in the CookieController.ListCookies function of client-engine-application/w.cs of the Cookie Controller component. Manipulation of the guid argument results in information disclosure and the attack can be executed remotely.
- CVE-2026-116280Medium
A vulnerability was determined in Kameleo up to 5.0.1.26 in the InternalController.TestProxy function of client-engine-application/f.cs of the Proxy Validation component. Manipulation of the host/port argument can lead to server-side request forgery and the attack may be launched remotely.
Original NVD description (English source)
A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses this issue. Upgrading the affected component is recommended.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS