Information disclosure in Kameleo Local API profiles file
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-284.
Summary
Kameleo up to 5.0.1.26 contains an access control weakness in the Local API profiles file. Missing access control lets unauthorized parties read sensitive information through that file (CWE-284). A remote attacker without privileges can obtain this information, but the attack requires user interaction.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
Description from the CNA
A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue. Upgrading the affected component is advised.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Kameleo | 5.0.1.0; 5.0.1.1; 5.0.1.2; 5.0.1.3; 5.0.1.4; 5.0.1.5; 5.0.1.6; 5.0.1.7; 5.0.1.8; 5.0.1.9; 5.0.1.10; 5.0.1.11; 5.0.1.12; 5.0.1.13; 5.0.1.14; 5.0.1.15; 5.0.1.16; 5.0.1.17; 5.0.1.18; 5.0.1.19; 5.0.1.20; 5.0.1.21; 5.0.1.22; 5.0.1.23; 5.0.1.24; 5.0.1.25; 5.0.1.26 | 5.2.0 | Patch available | CNA |
- Kameleo Vendor— Affected 5.0.1.0; 5.0.1.1; 5.0.1.2; 5.0.1.3; 5.0.1.4; 5.0.1.5; 5.0.1.6; 5.0.1.7; 5.0.1.8; 5.0.1.9; 5.0.1.10; 5.0.1.11; 5.0.1.12; 5.0.1.13; 5.0.1.14; 5.0.1.15; 5.0.1.16; 5.0.1.17; 5.0.1.18; 5.0.1.19; 5.0.1.20; 5.0.1.21; 5.0.1.22; 5.0.1.23; 5.0.1.24; 5.0.1.25; 5.0.1.26 Fixed in 5.2.0 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kameleo:kameleo:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:kameleo:kameleo:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
Upgrade Kameleo to version 5.2.0, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
- Fix · CNA Kameleo Fixed in 5.2.0
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116283
- 2026-10-27 Alias added: GHSA-rq8q-32wq-4xr7
- 2026-10-31 CISA SSVC decision points changed
References
Sources
- CVE-2026-116283 · CVE Program
- CVE-2026-116283 · NVD
- FIRST EPSS
- GHSA-rq8q-32wq-4xr7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences