Kameleo CVE-2026-116283

Requires a vulnerable Kameleo installation (up to 5.0.1.26) that is running with its Local API component active and the /profiles endpoint reachable by the attacker's request path. The CVSS vector's UI:P indicates a victim-side action is needed (consistent with a browser/cross-origin request reaching the local API), and PR:N indicates no authentication is required. Limiting factors: Kameleo and its Local API must be running at exploitation time, the target must be on an affected version, and user interaction is required - reducing this to opportunistic rather than mass remote exploitation. The exact mechanism by which /profiles leaks data is not described in the available sources; impact is limited to confidentiality (VC:L), with the likely exposed content being profile data such as stored proxy passwords (inferred from the 5.2.0 security note, not confirmed for this CVE).

Signals point to a moderate, plan-and-patch issue rather than an urgent one. The input CVSS 4.0 base is 5.3 (medium) with AV:N/AC:L/PR:N/UI:P and only low confidentiality impact (VC:L, no integrity/availability effect). No EPSS score is provided and the flaw is NOT in CISA KEV, so there is no evidence of active exploitation. A public PoC reference exists (a Google Drive link in the VulDB submission) but it is not verified as working exploit code, so POC availability must not be read as exploitation. The vuln.today decision label is 'this_month', consistent with medium severity and no confirmed in-the-wild use. One signal conflict must be flagged: the affected component is the 'Local API' (which normally binds to loopback/localhost) yet the description claims the attack is 'possible to be carried out remotely' - this is most plausibly a browser-driven cross-origin request to the local API (consistent with UI:P requiring a victim action) rather than direct internet-facing exposure; verify the listening interface and CORS behavior with the vendor before rating it as truly network-reachable. Net: a real but non-emergency credential/information disclosure in a niche product - schedule the 5.2.0 upgrade this month.

A victim running a vulnerable Kameleo build (≤5.0.1.26) with the Local API active is induced to perform an action (UI:P) - most plausibly visiting a malicious web page that issues a request to the local /profiles endpoint - which returns profile data, potentially including sensitive fields such as stored proxy credentials. The attack needs no authentication (PR:N) and is low complexity (AC:L). A public PoC reference exists but it is not verified as working exploit code, and there is no confirmed active exploitation.