CVE-2026-45246

MEDIUM EPSS 3.5%
Published May 18, 20261mo ago · Modified Jun 17, 20261w ago
6.8 CVSS 4.0
Medium
Find Similar
Published May 18, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on shared Unix-like systems.

CVSS Details

Base Score
6.8
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
3.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-732

Affected Products 1

VendorProductVersionRange
steipetesummarize* <0.15.1

References 4

  • github.com https://github.com/steipete/summarize/commit/9e990193650a23dab73f37d5e1964d574a44098b
    Patch
  • github.com https://github.com/steipete/summarize/pull/217
    ExploitIssue TrackingPatch
  • github.com https://github.com/steipete/summarize/releases/tag/v0.15.2
    Release Notes
  • vulncheck.com https://www.vulncheck.com/advisories/summarize-insecure-file-permissions-information-disclosure
    Third Party Advisory

Remediation

  • github.com https://github.com/steipete/summarize/commit/9e990193650a23dab73f37d5e1964d574a44098b
    Patch
  • github.com https://github.com/steipete/summarize/pull/217
    ExploitIssue TrackingPatch