A weakness in Kameleo affects an unknown part of the /profiles file in the Local API component, allowing a remote attacker to obtain sensitive profile information. The flaw is a classic information‑disclosure vulnerability identified as CWE-200 and also involves improper authorization controls (CWE-284). The exposed data could contain usernames, tokens, or other configuration details that compromise confidentiality. The description specifies that the manipulation enables disclosure, but does not detail the exact payload or result size, so the attacker’s impact is limited to data enumeration rather than arbitrary code execution or denial of service.

The affected product is Kameleo, versions up to 5.0.1.26, specifically the Local API component handling the /profiles endpoint. Version 5.2.0 and later contain the fix and are not affected.

The CVSS score of 5.3 indicates a moderate risk and the EPSS score is not provided, implying no known widespread exploitation data. The vulnerability is not listed in CISA KEV. The attack can be performed remotely, so any machine running the vulnerable Kameleo instance and reachable over the network is a potential target. Because the flaw reveals sensitive data without requiring privileged credentials, it is likely to be exploited by threat actors seeking reconnaissance or credential harvesting. The lack of a KEV listing suggests it is not a known widespread exploit, but the remote nature warrants prompt patching.