PT-2026-41725 · Steipete · Summarize

Published 2026-05-18 · Updated 2026-05-20 · CVE-2026-45246

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Summarize versions prior to 0.15.1

Description An insecure file permission issue exists in the refresh-free configuration rewrite path. When the software rewrites the configuration file, it creates the replacement using default process umask permissions rather than preserving the original file permissions. This allows local users on shared Unix-like systems to read sensitive credentials, such as API keys and provider credentials, stored within the configuration file.

Recommendations Update to version 0.15.1.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2026-45246

Affected Products

Summarize

References · 8

• https://github.com/steipete/summarize/commit/9e990193650a23dab73f37d5e1964d574a44098b · Patch
• https://github.com/steipete/summarize/pull/217 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45246 · Security Note
• https://github.com/steipete/summarize/releases/tag/v0.15.2 · Note
• https://vulncheck.com/advisories/summarize-insecure-file-permissions-information-disclosure · Note
• https://twitter.com/CVEnew/status/2056994233064804700 · Twitter Post
• https://twitter.com/infoflowcloud/status/2056994926907289768 · Twitter Post
• https://t.me/CVEtracker/54166 · Telegram Post