CVE-2026-116284EUVD-2026-109931GHSA-XCQH-RJGG-CP92
Kameleo Local API user-info information disclosure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Kameleo, a browser fingerprinting and profile management tool, is affected through its Local API component, where a flaw in the user-info endpoint can expose information to remote parties. The vendor did not respond to early notification of the issue.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- n/a Kameleo
5.3.0, 5.3.1