CVE-2026-116282 PUBLISHED

Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure

Assigner: VulDB
Reserved: 25.10.2026 Published: 26.10.2026 Updated: 26.10.2026

A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
CVSS Score: 5.3

Product Status

Vendor n/a
Product Kameleo
Versions
  • Version 5.3.0 is affected
  • Version 5.3.1 is affected

Credits

  • notwo1f finder
  • researchersongwu (VulDB User) reporter
  • researchersongwu (VulDB User) analyst
  • VulDB CNA Team coordinator

References

Problem Types

  • Information Disclosure CWE
  • Improper Access Controls CWE