CVE-2026-48790
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform
CVSS
5.5
Medium
EPSS
0.1%
p4
KEV
—
Exploit Today
1
0-100
Published: Aug 11, 2026 · Last modified: Oct 23, 2026 · CWE-276 · CWE-732
0.1%EPSS · 30 days0.1%
2026-10-012026-10-29
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.
- github.comhttps://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688
- github.comhttps://github.com/spf13/viper/blob/v1.21.0/viper.go#L198
- github.comhttps://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66
- github.comhttps://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1114995.5 MED—
———Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.7hCVE-2026-118574——
——0Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.19hCVE-2026-1070527.5 HIG—
——0Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.1dCVE-2026-1070477.5 HIG—
——0Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.1dCVE-2026-1141487.8 HIG—
——0Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.9hCVE-2026-1070427.5 HIG—
——0Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI.1d