CVE-2026-48790
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform
CVSS
5.5
Medio
EPSS
0.1%
p4
KEV
—
Exploit Today
1
0-100
Publicado: 11 ago 2026 · Última mod.: 23 oct 2026 · CWE-276 · CWE-732
0.1%EPSS · 30 días0.1%
2026-10-022026-10-29
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.
- github.comhttps://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688
- github.comhttps://github.com/spf13/viper/blob/v1.21.0/viper.go#L198
- github.comhttps://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66
- github.comhttps://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1114995.5 MED—
———Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.8hCVE-2026-118574——
——0Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.5hCVE-2026-1070609.1 CRÍ—
——0Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.6hCVE-2026-1070557.5 ALT—
——0Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.5hCVE-2026-1070527.5 ALT—
——0Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.5hCVE-2026-1070477.5 ALT—
——0Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.5h