CVE-2026-45222
Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem perm
CVSS
6.1
Medio
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Publicado: 11 may 2026 · Última mod.: 14 jul 2026 · CWE-732
0.1%EPSS · 30 días0.1%
2026-06-302026-07-16
Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json. A local attacker can exploit these permissive permissions to read the daemon bearer token and persisted provider credentials, enabling unauthorized access to the daemon or recovery of sensitive API keys.
- github.comhttps://github.com/steipete/summarize/commit/0cfb0fb99777a87a7b02082b5e4bd449f8dd6175
- github.comhttps://github.com/steipete/summarize/pull/214
- www.vulncheck.comhttps://www.vulncheck.com/advisories/summarize-insecure-daemon-configuration-file-permissions
- github.comhttps://github.com/steipete/summarize/pull/214
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2021-341107.8 ALT63.4%
——19WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executable with a malicious file that will be executed with "LocalSystem" privileges.8dCVE-2017-176778.8 ALT60.4%
——18BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code.8dCVE-2022-262817.5 ALT56.5%
——17BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue.8dCVE-2023-317487.8 ALT53.4%
——16Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file.8dCVE-2023-390049.8 CRÍ51.9%
——16Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.8dCVE-2021-406496.5 MED51.6%
——15In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set.8d