Kameleo EUVD-2026-109931

Requires a target running Kameleo (versions up to 5.3.1) with the Local API component active and reachable by the attacker's request path; the UI:P metric means the victim must be induced to perform some interaction (such as visiting an attacker-controlled page that triggers the /general/user-info request). Limiting factors: exploitation yields only low-confidentiality information disclosure (no integrity/availability impact), depends on the Local API being enabled and exposed (it is typically a localhost-bound service, so a browser-mediated or cross-origin trigger is the plausible network path), and requires the user-interaction step. The exact trigger mechanism and the precise data disclosed are not described in the available sources.

This is a medium-severity information-disclosure issue (CVSS 4.0 base 5.3) whose real-world priority is modest. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N) indicates a network-reachable flaw with low complexity and no required privileges, but it also carries UI:P (passive user interaction) and only low confidentiality impact (VC:L), with no integrity or availability impact - so this is limited leakage of information from the Local API's /general/user-info endpoint, not a system compromise. The vuln.today decision label is 'this_month', not act_now or emergency, which matches a moderate, non-urgent profile. No CISA KEV listing is present and no EPSS score was provided, so there is no evidence of active or widespread exploitation; absence of these signals is not proof of safety but gives no indication of mass exploitation. A PoC artifact is referenced (a Google Drive link) but it is not confirmed as working exploit code. Note two tensions to verify: the vector is AV:N on a component named 'Local API' (typically bound to localhost), so network reachability likely depends on a browser-mediated or cross-origin path rather than direct remote access - verify the actual exposure of the Local API; and the vendor did not respond to disclosure, so no vendor-confirmed fix or affected-range validation exists.

An attacker lures a user who is running Kameleo (version up to 5.3.1) with its Local API active to a malicious or attacker-controlled web page; the page issues requests to the local /general/user-info endpoint and reads back user information disclosed by the component. The UI:P metric reflects that the victim must be induced to interact (e.g., visit the page) for the disclosure to occur. A PoC reference exists but is not verified as working exploit code.