CVE-2026-116282
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A security flaw has been discovered in Kameleo up to 5.3.1 in the CookieController.ListCookies function of client-engine-application/w.cs of the Cookie Controller component. Manipulation of the guid argument results in information disclosure and the attack can be executed remotely.
Risk Assessment
This may result in unauthorized disclosure of data, including cookies, via a remote attack. Risk applies to Kameleo installations up to version 5.3.1.
Recommendation
Restrict access to the Cookie Controller component and apply access controls. Monitor the vendor for a fix, as they did not respond to the disclosure.
Other vulnerabilities in Kameleo
See all- CVE-2026-116284Medium
A security vulnerability has been detected in Kameleo up to 5.3.1 affecting unknown code of the file /general/user-info of the Local API component. Such manipulation leads to information disclosure, and the attack may be performed remotely. The vendor did not respond to the disclosure.
- CVE-2026-116283Medium
A weakness has been identified in Kameleo up to 5.0.1.26 affecting an unknown part of the /profiles file of the Local API component. The manipulation causes information disclosure and the attack can be carried out remotely.
- CVE-2026-116281Low
In Kameleo up to 5.0.1.26, the ListProfiles function in client-engine-application/t.cs of the Profile Controller component leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses the issue.
- CVE-2026-116280Medium
A vulnerability was determined in Kameleo up to 5.0.1.26 in the InternalController.TestProxy function of client-engine-application/f.cs of the Proxy Validation component. Manipulation of the host/port argument can lead to server-side request forgery and the attack may be launched remotely.
Original NVD description (English source)
A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS