CVE-2026-45246 Summarize < 0.15.1 Insecure File Permissions Information Disclosure
Local attackers can read sensitive API keys and credentials from configuration files due to insecure default file permissions during refresh-free rewrites.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45246?
CVE-2026-45246 is a medium-severity vulnerability in steipete summarize, published on 18 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on shared Unix-like systems.
Weakness: CWE-732
Which versions are affected by CVE-2026-45246?
It affects 1 product.
Products include Steipete Summarize.
How do I fix CVE-2026-45246?
No fix has been published for CVE-2026-45246 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-45246 being exploited?
There is no known exploitation of CVE-2026-45246 in the wild and no public exploit code.
Other vulnerabilities in steipete summarize
- CVE-2026-45242 Summarize < 0.15.1 Path Traversal via slidesDir Parameter
- CVE-2026-45243 Summarize < 0.15.1 Browser Extension Missing Authorization via Content Script
- CVE-2026-45245 Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Events
- CVE-2026-45244 Summarize < 0.15.1 Unapproved Browser Automation Execution
Sources
Also known as GHSA-cjvq-x32c-xrmv.