CVE-2026-116283

Kameleo Local API profiles information disclosure

State: Published
Severity: 5.3 Medium
Published: Oct 26, 2026
Updated: Oct 31, 2026
Reserved: Oct 25, 2026

Description

A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue. Upgrading the affected component is advised.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-200 Information Disclosure
CWE-284 Improper Access Controls

Affected Products

Product	Versions
Kameleon/a	5.0.1.0Affected 5.0.1.1Affected 5.0.1.2Affected 5.0.1.3Affected 5.0.1.4Affected 5.0.1.5Affected 5.0.1.6Affected 5.0.1.7Affected 5.0.1.8Affected 5.0.1.9Affected 5.0.1.10Affected 5.0.1.11Affected 5.0.1.12Affected 5.0.1.13Affected 5.0.1.14Affected 5.0.1.15Affected 5.0.1.16Affected 5.0.1.17Affected 5.0.1.18Affected 5.0.1.19Affected 5.0.1.20Affected 5.0.1.21Affected 5.0.1.22Affected 5.0.1.23Affected 5.0.1.24Affected and 3 more versions

Product

Versions

Kameleon/a

5.0.1.0Affected
5.0.1.1Affected
5.0.1.2Affected
5.0.1.3Affected
5.0.1.4Affected
5.0.1.5Affected
5.0.1.6Affected
5.0.1.7Affected
5.0.1.8Affected
5.0.1.9Affected
5.0.1.10Affected
5.0.1.11Affected
5.0.1.12Affected
5.0.1.13Affected
5.0.1.14Affected
5.0.1.15Affected
5.0.1.16Affected
5.0.1.17Affected
5.0.1.18Affected
5.0.1.19Affected
5.0.1.20Affected
5.0.1.21Affected
5.0.1.22Affected
5.0.1.23Affected
5.0.1.24Affected
and 3 more versions

References

VDB-426308 | Kameleo Local API profiles information disclosurevdb-entry
VDB-426308 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-116283 | CVE Analysis and Reportthird-party-advisory
Submit #1011369 | https://kameleo.io/ Kameleo 5.0.1.26 Exposure of Sensitive Information due to the unauthenticationthird-party-advisory
https://drive.google.com/file/d/1ZuDXJSM1SQDNZogKq8oEQ6qtDI1TkGN7/view?usp=drive_linkbroken-link
https://github.com/kameleo-io/kameleo/releases/tag/5.2.0patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.