CVE-2026-45246

MediumCVSS 5.5/10Last modified Oct 14, 2026

Description

Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on shared Unix-like systems.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
steipete	summarize	< 0.15.1

References

https://github.com/steipete/summarize/commit/9e990193650a23dab73f37d5e1964d574a44098bPatch
https://github.com/steipete/summarize/pull/217Exploit, Issue Tracking, Patch
https://github.com/steipete/summarize/releases/tag/v0.15.2Release Notes
https://www.vulncheck.com/advisories/summarize-insecure-file-permissions-information-disclosureThird Party Advisory

Timeline

Published: May 18, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-452479.8Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticat CVE-2026-452485.3Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows CVE-2026-452496.1A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic. This issue affects Apac CVE-2026-45258.8If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Va CVE-2026-452507.8The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-su CVE-2026-452517.8A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked t CVE-2026-452525.5When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve t CVE-2026-452538.4ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with CVE-2026-452546.5In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allo CVE-2026-452557.5When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to p CVE-2026-452565.5When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but d CVE-2026-452577.8The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This