CVE-2026-116284: Kameleo Local API user-info information disclosure
A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Kameleo Local API deployments running Kameleo up to version 5.3.1 are identified as affected. The issue is associated with the Local API endpoint at /general/user-info.
Can this be exploited remotely without authentication?
The supplied CVSS vector indicates network-based attack access, low attack complexity, no required privileges, and user interaction required. The description states that the attack may be performed remotely.
What is the known impact of successful exploitation?
Successful exploitation may disclose information. The provided severity data indicates low confidentiality impact and no integrity or availability impact.
Is a vendor fix confirmed?
No vendor response or remediation is documented in the provided data. The vendor was contacted early about the disclosure but did not respond.