{"id":"CVE-2026-116281","title":"Kameleo Profile Controller t.cs ListProfiles information disclosure","summary":"A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information d…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-200","CWE-284"],"product":"Kameleo","affected":["Kameleo 5.0.1.0","Kameleo 5.0.1.1","Kameleo 5.0.1.2","Kameleo 5.0.1.3","Kameleo 5.0.1.4","Kameleo 5.0.1.5","Kameleo 5.0.1.6","Kameleo 5.0.1.7","Kameleo 5.0.1.8","Kameleo 5.0.1.9","Kameleo 5.0.1.10","Kameleo 5.0.1.11","Kameleo 5.0.1.12","Kameleo 5.0.1.13","Kameleo 5.0.1.14","Kameleo 5.0.1.15","Kameleo 5.0.1.16","Kameleo 5.0.1.17","Kameleo 5.0.1.18","Kameleo 5.0.1.19","Kameleo 5.0.1.20","Kameleo 5.0.1.21","Kameleo 5.0.1.22","Kameleo 5.0.1.23","Kameleo 5.0.1.24","Kameleo 5.0.1.25","Kameleo 5.0.1.26"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T13:00:10.760Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116281","references":[{"url":"https://vuldb.com/vuln/426306","label":"VDB-426306 | Kameleo Profile Controller t.cs ListProfiles information disclosure"},{"url":"https://vuldb.com/vuln/426306/cti","label":"VDB-426306 | CTI Indicators (IOB, IOC, TTP, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-116281","label":"CVE-2026-116281 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1011319","label":"Submit #1011319 | https://kameleo.io/ Kameleo 5.0.1.26 Exposure of profiles due to unauthentication"},{"url":"https://drive.google.com/file/d/1ZuDXJSM1SQDNZogKq8oEQ6qtDI1TkGN7/view?usp=drive_link"},{"url":"https://github.com/kameleo-io/kameleo/releases/tag/5.2.0"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T14:27:31.832Z","slug":"CVE-2026-116281","body":"## Overview\n\nA vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses this issue. Upgrading the affected component is recommended.\n\n## Affected\n\n- `Kameleo 5.0.1.0`\n- `Kameleo 5.0.1.1`\n- `Kameleo 5.0.1.2`\n- `Kameleo 5.0.1.3`\n- `Kameleo 5.0.1.4`\n- `Kameleo 5.0.1.5`\n- `Kameleo 5.0.1.6`\n- `Kameleo 5.0.1.7`\n- `Kameleo 5.0.1.8`\n- `Kameleo 5.0.1.9`\n- `Kameleo 5.0.1.10`\n- `Kameleo 5.0.1.11`\n- `Kameleo 5.0.1.12`\n- `Kameleo 5.0.1.13`\n- `Kameleo 5.0.1.14`\n- `Kameleo 5.0.1.15`\n- `Kameleo 5.0.1.16`\n- `Kameleo 5.0.1.17`\n- `Kameleo 5.0.1.18`\n- `Kameleo 5.0.1.19`\n- `Kameleo 5.0.1.20`\n- `Kameleo 5.0.1.21`\n- `Kameleo 5.0.1.22`\n- `Kameleo 5.0.1.23`\n- `Kameleo 5.0.1.24`\n- `Kameleo 5.0.1.25`\n- `Kameleo 5.0.1.26`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}