Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2026-116281: Kameleo up to 5.0.1.26 may leak profile data locally
CVE-2026-116281 · published 9 days ago
Summary
The ListProfiles function in Kameleo versions up to 5.0.1.26 can expose information about user profiles when run on the same machine. This could allow someone with local access to see details they should not see. Updating Kameleo to version 5.2.0 resolves the issue.
Original advisory text
Kameleo Profile Controller t.cs ListProfiles information disclosure
A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses this issue. Upgrading the affected component is recommended.
References
- https://drive.google.com/file/d/1ZuDXJSM1SQDNZogKq8oEQ6qtDI1TkGN7/view?usp=drive... URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-1162... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-116281 Vendor Advisory
- https://github.com/kameleo-io/kameleo/releases/tag/5.2.0 Patch
- https://vuldb.com/cve/CVE-2026-116281 Vendor Advisory
- https://vuldb.com/submit/1011319 Vendor Advisory
- https://vuldb.com/vuln/426306 Vendor Advisory
- https://vuldb.com/vuln/426306/cti Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.3
Medium
Type
CWE-200Information Exposure
CWE-284Improper Access Control
Timeline
Published26 Oct 2026
Updated3 Nov 2026
First seen26 Oct 2026
Track software like this
Free during beta