Vulnerability · Published Mar 26, 2026 · Assigned by GitHub_M
CVE-2026-33430Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions
High 7.3
In plain English
A high-severity incorrect permission assignment in briefcase from beeware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Briefcase is a tool for converting a Python project into a standalone native application. Starting in version 0.3.0 and prior to version 0.3.26, if a developer uses Briefcase to produce an Windows MSI installer for a project, and that project is installed for All Users (i.e., per-machine scope), the installation process creates an directory that inherits all the permissions of the parent directory. Depending on the location chosen by the installing user, this may allow a low privilege but authenticated user to replace or modify the binaries installed by the application. If an administrator then runs the altered binary, the binary will run with elevated privileges. The problem is caused by the template used to generate the WXS file for Windows projects. It was fixed in the templates used in Briefcase 0.3.26, 0.4.0, and 0.4.1. Re-running `briefcase create` on your Briefcase project will result in the updated templates being used. As a workaround, the patch can be added to any existing Briefcase .wxs file generated by Briefcase 0.3.24 or later.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | briefcase | 0.3.26 | GHSA-r3r2-35v9-v238 |
| PyPI | briefcase | 0.3.26 | PYSEC-2026-27 |
Affected products (as reported)
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/beeware/briefcase/security/advisories/GHSA-r3r2-35v9-v238 x_refsource_CONFIRM
- https://github.com/beeware/briefcase/issues/2759 x_refsource_MISC
- https://github.com/beeware/briefcase-windows-VisualStudio-template/pull/85 x_refsource_MISC
- https://github.com/beeware/briefcase-windows-app-template/pull/86 x_refsource_MISC