Vulnerability · Published May 18, 2026 · Assigned by VulnCheck

CVE-2026-45246Summarize < 0.15.1 Insecure File Permissions Information Disclosure

Medium 5.5

In plain English

A medium-severity incorrect permission assignment in summarize from steipete. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.1%top 96.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on shared Unix-like systems.

Affected products (as reported)

Vendor	Product	Versions
steipete	summarize	0 – before 0.15.1

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/steipete/summarize/releases/tag/v0.15.2 release-notes
https://github.com/steipete/summarize/pull/217 issue-tracking
https://github.com/steipete/summarize/commit/9e990193650a23dab73f37d5e1964d574a44098b patch
https://www.vulncheck.com/advisories/summarize-insecure-file-permissions-information-disclosure third-party-advisory