Technical impact
A vulnerability in the Kameleo Local API allows an attacker to retrieve details from the /general/user-info endpoint. The flaw can expose sensitive user information, potentially compromising the confidentiality of credentials and personal data. It is inferred that authentication may not be required, as the description indicates that the information disclosure can be achieved by simply contacting the endpoint, but the advisory does not explicitly state authentication requirements.
Affected Systems
The defect exists in Kameleo versions up to 5.3.1. All installations of Kameleo that expose the Local API component are potentially vulnerable, regardless of platform or deployment scenario. No specific subcomponents or OS versions are singled out in the advisory.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity, and there is no EPSS data and the vulnerability is not in the CISA KEV catalog. The attack may be performed remotely, meaning the attacker needs only remote network access to the Kameleo instance. An attacker who can reach the Local API would be able to read user data by sending a request to the /general/user-info endpoint. The lack of proper authentication or authorization checks is inferred from the description, enabling this simple, but potentially impactful exploitation.
