CVE-2026-116283: Kameleo Local API profiles information disclosure
A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kameleoto a version that resolves this vulnerability.Fixed in 5.2.0
Event History
Frequently Asked Questions
Which deployments are affected?
Kameleo Local API installations running Kameleo up to version 5.0.1.26 are affected. Version 5.2.0 is identified as mitigating the issue.
Can this be exploited remotely without credentials?
The issue is described as remotely exploitable, and the vector lists network access with no privileges required. User interaction is required for exploitation.
What is the impact of successful exploitation?
Successful exploitation can disclose information through an unknown part of the Local API /profiles file or endpoint. The available data indicates low confidentiality impact and no integrity or availability impact.
What should teams do if they are running an affected version?
Upgrade Kameleo to version 5.2.0, which is identified as mitigating the issue. No alternative workaround is provided in the available information.