---
id: "CVE-2026-116283"
kind: "vulnerability"
aliases: ["CVE-2026-116283"]
title: "Kameleo Local API: /profiles endpoint leaks information to remote attackers"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["desktop", "kameleo", "local-api", "other"]
not_affected_if: ["version-5.2.0-or-later"]
published_at: "2026-10-26T14:16:36+00:00"
first_seen_at: "2026-10-26T14:30:37+00:00"
updated_at: "2026-10-26T14:32:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116283", "first_seen_at": "2026-10-26T14:30:37+00:00"}]
---

# Kameleo Local API: /profiles endpoint leaks information to remote attackers

Kameleo, a browser profile manager, has a weakness in the /profiles path of its Local API that lets a remote attacker obtain information. The sources do not say what data is exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kameleo version against `5.0.1.26` in the application's About screen or install directory
- Review whether the Kameleo Local API port is reachable from outside the machine (unknown for the exact port in the sources)

## Fix

- Upgrade Kameleo to `5.2.0` or later, per the NVD description

## Timeline

- 2026-10-26T14:30:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116283

## From the sources

A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue. Upgrading the affected component is advised.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_