---
id: CVE-2026-116281
title: Kameleo Profile Controller t.cs ListProfiles information disclosure
summary: >-
  A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this
  vulnerability is the function ListProfiles of the file
  client-engine-application/t.cs of the component Profile Controller. The
  manipulation leads to information d…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-200
  - CWE-284
product: Kameleo
affected:
  - Kameleo 5.0.1.0
  - Kameleo 5.0.1.1
  - Kameleo 5.0.1.2
  - Kameleo 5.0.1.3
  - Kameleo 5.0.1.4
  - Kameleo 5.0.1.5
  - Kameleo 5.0.1.6
  - Kameleo 5.0.1.7
  - Kameleo 5.0.1.8
  - Kameleo 5.0.1.9
  - Kameleo 5.0.1.10
  - Kameleo 5.0.1.11
  - Kameleo 5.0.1.12
  - Kameleo 5.0.1.13
  - Kameleo 5.0.1.14
  - Kameleo 5.0.1.15
  - Kameleo 5.0.1.16
  - Kameleo 5.0.1.17
  - Kameleo 5.0.1.18
  - Kameleo 5.0.1.19
  - Kameleo 5.0.1.20
  - Kameleo 5.0.1.21
  - Kameleo 5.0.1.22
  - Kameleo 5.0.1.23
  - Kameleo 5.0.1.24
  - Kameleo 5.0.1.25
  - Kameleo 5.0.1.26
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T13:00:10.760Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116281'
references:
  - url: 'https://vuldb.com/vuln/426306'
    label: >-
      VDB-426306 | Kameleo Profile Controller t.cs ListProfiles information
      disclosure
  - url: 'https://vuldb.com/vuln/426306/cti'
    label: 'VDB-426306 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-116281'
    label: CVE-2026-116281 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1011319'
    label: >-
      Submit #1011319 | https://kameleo.io/ Kameleo 5.0.1.26 Exposure of
      profiles due to unauthentication
  - url: >-
      https://drive.google.com/file/d/1ZuDXJSM1SQDNZogKq8oEQ6qtDI1TkGN7/view?usp=drive_link
  - url: 'https://github.com/kameleo-io/kameleo/releases/tag/5.2.0'
tags:
  - cve.org
ingestedAt: '2026-10-26T14:27:31.832Z'
---

## Overview

A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses this issue. Upgrading the affected component is recommended.

## Affected

- `Kameleo 5.0.1.0`
- `Kameleo 5.0.1.1`
- `Kameleo 5.0.1.2`
- `Kameleo 5.0.1.3`
- `Kameleo 5.0.1.4`
- `Kameleo 5.0.1.5`
- `Kameleo 5.0.1.6`
- `Kameleo 5.0.1.7`
- `Kameleo 5.0.1.8`
- `Kameleo 5.0.1.9`
- `Kameleo 5.0.1.10`
- `Kameleo 5.0.1.11`
- `Kameleo 5.0.1.12`
- `Kameleo 5.0.1.13`
- `Kameleo 5.0.1.14`
- `Kameleo 5.0.1.15`
- `Kameleo 5.0.1.16`
- `Kameleo 5.0.1.17`
- `Kameleo 5.0.1.18`
- `Kameleo 5.0.1.19`
- `Kameleo 5.0.1.20`
- `Kameleo 5.0.1.21`
- `Kameleo 5.0.1.22`
- `Kameleo 5.0.1.23`
- `Kameleo 5.0.1.24`
- `Kameleo 5.0.1.25`
- `Kameleo 5.0.1.26`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.