Dashboard / CVE-2026-45246

CVE-2026-45246

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 39/100
Published: 2026-05-18 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: None
VA: None

Description

Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on shared Unix-like systems.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
steipete summarize 0 < 0.15.1

References & Advisories (4)

Bug Bounty Relevance

39 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

6.8 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.14%
Raw Score 0.001370
Percentile 3.1%
Date 2026-11-08

Intelligence Sources

mitre ref →

External Links