{"id":"CVE-2026-116284","kind":"vulnerability","aliases":["CVE-2026-116284"],"related":[],"title":"Kameleo: Local API endpoint /general/user-info leaks information to remote attackers","description":"A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Kameleo up to version 5.3.1 exposes information through the /general/user-info path of its Local API. A remote attacker can read data from that endpoint without the sources describing what the data contains.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kameleo","local-api","other"],"not_affected_if":[],"how_to_check":"- Check the installed Kameleo version and whether it is `5.3.1` or earlier\n- unknown","fix":"- unknown: the sources report no fixed version and the vendor did not respond to the disclosure","status":"open","published_at":"2026-10-26T15:16:39+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","triaged_at":"2026-10-26T16:03:54+00:00","updated_at":"2026-10-26T16:03:54+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T16:03:54Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources report no fixed version and the vendor did not respond to the disclosure","reach":"network","title":"Kameleo: Local API endpoint /general/user-info leaks information to remote attackers","impact":"low","summary":"Kameleo up to version 5.3.1 exposes information through the /general/user-info path of its Local API. A remote attacker can read data from that endpoint without the sources describing what the data contains.","category":"other","nicknames":[],"who_cares":["kameleo","local-api"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker reads information returned by the user-info endpoint","analyst_note":"Confirm the data exposed by /general/user-info, whether the Local API listens beyond localhost by default, and whether any fixed version exists; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116284","how_to_check":"- Check the installed Kameleo version and whether it is `5.3.1` or earlier\n- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Kameleo 5.3.1 or earlier with the Local API reachable over the network. The sources do not say whether the endpoint is enabled by default or what data it returns.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00057,"input_tokens":3309,"output_tokens":478,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116284':13A,16A '-2026':12A,15A '/general/user-info':5A,30B,72C '5.3.1':25B,63C 'affect':66C 'api':3A,20B,35B,77C 'attack':10A,38B,85C 'code':68C 'compon':75C 'contact':94C 'contain':52B 'cve':11A,14A 'data':41B,51B 'describ':48B 'detect':58C 'disclosur':83C,98C 'earli':95C 'endpoint':4A,44B 'expos':26B 'file':71C 'inform':7A,27B,82C 'kameleo':1A,17B,21B,60C 'lead':80C 'leak':6A 'local':2A,19B,34B,76C 'local-api':18B 'manipul':79C 'may':86C 'path':31B 'perform':88C 'read':40B 'remot':9A,37B,90C 'respond':102C 'secur':54C 'sourc':47B 'unknown':67C 'vendor':92C 'version':24B 'vulner':55C,65C 'way':105C 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Teams running Kameleo 5.3.1 or earlier with the Local API reachable over the network. The sources do not say whether the endpoint is enabled by default or what data it returns.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116284","severity":null,"published_at":"2026-10-26T15:16:39+00:00","modified_at":"2026-10-26T15:16:39+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","fetched_at":"2026-10-26T16:02:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}