{"id":"CVE-2026-45246","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-45246","generatedAt":"2026-10-28T02:18:22.805Z","title":"Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions.","description":"Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on shared Unix-like systems.","published":"2026-05-18T20:16:39.000Z","lastModified":"2026-10-14T20:10:00.000Z","status":"Analyzed","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":6.8,"severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-732"],"affected":["steipete/summarize"],"epss":{"score":0.00137,"percentile":0.0305,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/steipete/summarize/commit/9e990193650a23dab73f37d5e1964d574a44098b","tags":["Patch"],"source":"disclosure@vulncheck.com"},{"url":"https://github.com/steipete/summarize/pull/217","tags":["Exploit","Issue Tracking","Patch"],"source":"disclosure@vulncheck.com"},{"url":"https://github.com/steipete/summarize/releases/tag/v0.15.2","tags":["Release Notes"],"source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/summarize-insecure-file-permissions-information-disclosure","tags":["Third Party Advisory"],"source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-45246","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}