CVE-2026-116282: Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure
A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Kameleo versions up to and including 5.3.1 are affected. The issue is in the Cookie Controller's CookieController.ListCookies function in client-engine-application/w.cs.
What must an attacker do to exploit the issue?
The attack can be performed remotely and does not require privileges, but it requires user interaction according to the supplied severity vector. Exploitation involves manipulating the guid argument supplied to CookieController.ListCookies.
What is the impact of successful exploitation?
Successful exploitation can disclose information. The provided metrics indicate low confidentiality impact and no stated integrity or availability impact.
Is a vendor fix or mitigation available?
The provided data does not identify a patch, workaround, or mitigation. It states that the vendor was contacted but did not respond.