CVE-2026-116283
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A weakness has been identified in Kameleo up to 5.0.1.26 affecting an unknown part of the /profiles file of the Local API component. The manipulation causes information disclosure and the attack can be carried out remotely.
Risk Assessment
This may lead to unauthorized disclosure of information through the local API. Risk applies to Kameleo installations up to version 5.0.1.26.
Recommendation
Upgrade Kameleo to version 5.2.0 or later. Upgrading the affected component is advised.
Other vulnerabilities in Kameleo
See all- CVE-2026-116284Medium
A security vulnerability has been detected in Kameleo up to 5.3.1 affecting unknown code of the file /general/user-info of the Local API component. Such manipulation leads to information disclosure, and the attack may be performed remotely. The vendor did not respond to the disclosure.
- CVE-2026-116282Medium
A security flaw has been discovered in Kameleo up to 5.3.1 in the CookieController.ListCookies function of client-engine-application/w.cs of the Cookie Controller component. Manipulation of the guid argument results in information disclosure and the attack can be executed remotely.
- CVE-2026-116281Low
In Kameleo up to 5.0.1.26, the ListProfiles function in client-engine-application/t.cs of the Profile Controller component leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses the issue.
- CVE-2026-116280Medium
A vulnerability was determined in Kameleo up to 5.0.1.26 in the InternalController.TestProxy function of client-engine-application/f.cs of the Proxy Validation component. Manipulation of the host/port argument can lead to server-side request forgery and the attack may be launched remotely.
Original NVD description (English source)
A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue. Upgrading the affected component is advised.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS