Description
A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses this issue. Upgrading the affected component is recommended.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Kameleo | 5.0.1.0, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0.1.7, 5.0.1.8, 5.0.1.9, 5.0.1.10, 5.0.1.11, 5.0.1.12, 5.0.1.13, 5.0.1.14, 5.0.1.15, 5.0.1.16, 5.0.1.17, 5.0.1.18, 5.0.1.19, 5.0.1.20, 5.0.1.21, 5.0.1.22, 5.0.1.23, 5.0.1.24, 5.0.1.25, 5.0.1.26 | 5.2.0 |
References
- VDB-426306 | Kameleo Profile Controller t.cs ListProfiles information disclosure vdb-entry technical-description
- VDB-426306 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-116281 | CVE Analysis and Report third-party-advisory
- Submit #1011319 | https://kameleo.io/ Kameleo 5.0.1.26 Exposure of profiles due to unauthentication third-party-advisory
- https://drive.google.com/file/d/1ZuDXJSM1SQDNZogKq8oEQ6qtDI1TkGN7/view?usp=drive_link broken-link
- https://github.com/kameleo-io/kameleo/releases/tag/5.2.0 patch