Kameleo EUVD-2026-109802

Exploitation requires local access to a system running Kameleo (version up to 5.0.1.26) together with low-privilege authentication (PR:L), per the supplied CVSS 4.0 vector; remote and fully unauthenticated exploitation is not possible. The specific trigger is the ListProfiles function of the Profile Controller (client-engine-application/t.cs), which discloses profile information (CWE-200); the exact mechanism by which the disclosure occurs is not described in the available sources. Limiting factors: the attacker must already have a local foothold and valid low-privilege credentials/session on the host, impact is confined to information disclosure with no integrity or availability effect, and affected deployments are limited to Kameleo installations at or below 5.0.1.26.

The input provides a CVSS 4.0 base vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scoring 4.8 (medium). The signals are internally consistent and point to a constrained, low-to-medium real-world risk: the attack vector is local (AV:L), so remote exploitation is not possible, and it requires low-privilege authentication (PR:L) on the host running Kameleo. Impact is limited to low confidentiality (VC:L) with no integrity or availability impact. No EPSS score and no KEV listing are present in the input, so there is no signal of active exploitation or statistically likely exploitation. A PoC reference (a Google Drive link) is present in the references, but it is a reference only and is not verified as working exploit code. The vendor's own decision/priority label is 'this_month' rather than act_now/emergency, which aligns with a patch-in-routine-cycle posture rather than an urgent fire. Overall this is a legitimate medium-severity information-disclosure issue, not a high-CVSS-but-trivial-risk case nor an urgent one - the local access plus authentication requirement meaningfully limits exposure. Note the CVSS and description agree (both indicate local, not network, access), so there is no vector/description conflict to flag.

A local, low-privileged user (or malware running in that user's context) on a machine running KameLeo invokes the ListProfiles function of the Profile Controller and obtains profile information that should not be exposed at that privilege level. A public PoC reference exists (a Google Drive link in the CVE references); it is not verified as working exploit code. Because the vector is local and authenticated, exploitation presumes the attacker already has a foothold and valid low-privilege access on the host.