CVE-2026-116282

Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability is located in the CookieController.ListCookies method of Kameleo’s client‑engine‑application. By manipulating the input argument GUID, a remote attacker can trigger the disclosure of cookie data. Cookies may contain authentication tokens, session identifiers or other sensitive information, so the impact is the unauthorized exposure of secrets that could be used for session hijacking or credential theft. This flaw is classified as an information exposure and an access‑control weakness.

Affected Systems

The flaw affects the Kameleo application, specifically the Cookie Controller component, in all releases up to and including version 5.3.1. The product is listed by the CNA as Kameleo, and the affected versions are those that include the buggy CookieController implementation.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity. The EPSS score is not available, so the exact exploitation probability is unknown; however, the attack can be performed remotely without local privileges. The vulnerability is not currently listed in the CISA KEV catalog. An attacker who discovers the exposed endpoint can craft a request that supplies a manipulated GUID, causing the server to return sensitive cookie data. Because no specific exploitation chain is detailed, the risk assessment relies on the known severity and the fact that remote disclosure is possible.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Identify the Kameleo version in use and upgrade to the latest release if the vendor has issued a patch for the CookieController.ListCookies flaw.
  • If an update is unavailable, configure the application or API gateway to deny external access to the CookieController.ListCookies endpoint or to enforce strict authentication and authorization checks before the function is invoked.
  • Apply network segmentation or firewall rules to restrict external traffic to the application server, ensuring that only trusted internal sources can reach the vulnerable endpoint, and enforce TLS and client‑certificate authentication where possible.

Generated by OpenCVE AI on October 26, 2026 at 15:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure
First Time appeared Kameleo
Kameleo kameleo
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:kameleo:kameleo:*:*:*:*:*:*:*:*
Vendors & Products Kameleo
Kameleo kameleo
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 26, 2026, 4:15 PM
Reserved
Oct 25, 2026, 7:17 PM

View source JSON

Updated
Oct 26, 2026, 3:42 PM

JSON

Status
Deferred
Published
Oct 26, 2026, 2:16 PM
Modified
Oct 26, 2026, 6:35 PM

View source JSON

No data.

Updated
Nov 3, 2026, 4:37 PM

JSON