{"id":"CVE-2026-116283","kind":"vulnerability","aliases":["CVE-2026-116283"],"related":[],"title":"Kameleo Local API: /profiles endpoint leaks information to remote attackers","description":"A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue. Upgrading the affected component is advised.","summary":"Kameleo, a browser profile manager, has a weakness in the /profiles path of its Local API that lets a remote attacker obtain information. The sources do not say what data is exposed.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","kameleo","local-api","other"],"not_affected_if":["version-5.2.0-or-later"],"how_to_check":"- Check the installed Kameleo version against `5.0.1.26` in the application's About screen or install directory\n- Review whether the Kameleo Local API port is reachable from outside the machine (unknown for the exact port in the sources)","fix":"- Upgrade Kameleo to `5.2.0` or later, per the NVD description","status":"open","published_at":"2026-10-26T14:16:36+00:00","first_seen_at":"2026-10-26T14:30:37+00:00","triaged_at":"2026-10-26T14:32:46+00:00","updated_at":"2026-10-26T14:32:46+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T14:32:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Kameleo to `5.2.0` or later, per the NVD description","reach":"internet","title":"Kameleo Local API: /profiles endpoint leaks information to remote attackers","impact":"low","summary":"Kameleo, a browser profile manager, has a weakness in the /profiles path of its Local API that lets a remote attacker obtain information. The sources do not say what data is exposed.","category":"other","nicknames":[],"who_cares":["kameleo","local-api","desktop"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker reads profile information from the Local API","analyst_note":"Check the NVD entry and vendor advisory to confirm what data /profiles exposes and whether authentication is required.","how_to_check":"- Check the installed Kameleo version against `5.0.1.26` in the application's About screen or install directory\n- Review whether the Kameleo Local API port is reachable from outside the machine (unknown for the exact port in the sources)","needs_analyst":true,"not_affected_if":["version-5.2.0-or-later"],"who_is_affected":"Installations of Kameleo up to and including 5.0.1.26 that expose the Local API. The sources do not say whether the flaw is reachable without authentication or on default configuration, so unknown. Teams on 5.2.0 or later are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000585,"input_tokens":3317,"output_tokens":506,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116283':13A,16A '-2026':12A,15A '/profiles':4A,32B,72C '5.0.1.26':63C '5.2.0':95C 'abl':97C 'advis':107C 'affect':65C,104C 'api':3A,21B,37B,77C 'attack':10A,42B,84C 'browser':24B 'carri':89C 'caus':80C 'compon':75C,105C 'cve':11A,14A 'data':51B 'desktop':17B 'disclosur':82C 'endpoint':5A 'expos':53B 'file':71C 'identifi':58C 'inform':7A,44B,81C 'issu':101C 'kameleo':1A,18B,22B,60C 'leak':6A 'let':39B 'local':2A,20B,36B,76C 'local-api':19B 'manag':26B 'manipul':79C 'mitig':99C 'obtain':43B 'part':68C 'path':33B 'possibl':86C 'profil':25B 'remot':9A,41B,91C 'say':49B 'sourc':46B 'unknown':67C 'upgrad':92C,102C 'version':94C 'weak':29B,55C","nicknames":[],"mitigations":[],"who_affected":"Installations of Kameleo up to and including 5.0.1.26 that expose the Local API. The sources do not say whether the flaw is reachable without authentication or on default configuration, so unknown. Teams on 5.2.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116283","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116283","severity":null,"published_at":"2026-10-26T14:16:36+00:00","modified_at":"2026-10-26T14:16:36+00:00","first_seen_at":"2026-10-26T14:30:37+00:00","fetched_at":"2026-10-26T14:30:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}