CVE-2026-116284
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A security vulnerability has been detected in Kameleo up to 5.3.1 affecting unknown code of the file /general/user-info of the Local API component. Such manipulation leads to information disclosure, and the attack may be performed remotely. The vendor did not respond to the disclosure.
Risk Assessment
Information disclosure through the local API may expose user or configuration data to unauthorized access. The vendor's lack of response hinders assessment and limits patch availability.
Recommendation
Restrict access to the Kameleo local API to trusted processes and networks only. Monitor vendor communications and apply a fix as soon as it becomes available.
Other vulnerabilities in Kameleo
See all- CVE-2026-116283Medium
A weakness has been identified in Kameleo up to 5.0.1.26 affecting an unknown part of the /profiles file of the Local API component. The manipulation causes information disclosure and the attack can be carried out remotely.
- CVE-2026-116282Medium
A security flaw has been discovered in Kameleo up to 5.3.1 in the CookieController.ListCookies function of client-engine-application/w.cs of the Cookie Controller component. Manipulation of the guid argument results in information disclosure and the attack can be executed remotely.
- CVE-2026-116281Low
In Kameleo up to 5.0.1.26, the ListProfiles function in client-engine-application/t.cs of the Profile Controller component leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses the issue.
- CVE-2026-116280Medium
A vulnerability was determined in Kameleo up to 5.0.1.26 in the InternalController.TestProxy function of client-engine-application/f.cs of the Proxy Validation component. Manipulation of the host/port argument can lead to server-side request forgery and the attack may be launched remotely.
Original NVD description (English source)
A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS