CVE-2026-32810

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Halloy is an IRC application written in Rust. In versions on \*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its config directory and files using default umask permissions, which typically results in `0644` on files and `0755` on directories. This allows any local user on the system to read plaintext credentials stored in `config.toml` or referenced `password_file` paths. Commit f180e41061db393acf65bc99f5c5e7397586d9cb patches the issue.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
squidowl	halloy	<= 2026.4

References

https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cbPatch
https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7gExploit, Vendor Advisory
https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7gExploit, Vendor Advisory

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-328117.5Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. When using Heimdall in envoy gRPC decision API mode wit CVE-2026-328126.8Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can resu CVE-2026-328138.0Admidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList co CVE-2026-328146.5libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decodi CVE-2026-328157.5SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the WebSocket endpoint (/ws) allows unauthenticated connectio CVE-2026-328165.7Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the delete, activate, and deactivate modes in modules/g CVE-2026-328179.1Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether CVE-2026-328186.5Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the forum module in Admidio does not verify whether the CVE-2026-328194.3dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the mod CVE-2026-32827.1A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unp CVE-2026-328207.5dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the mod CVE-2026-328218.1dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the mod