CVE-2026-50544

Name of the Vulnerable Software and Affected Versions NortheBridge/luminalshine versions prior to 26.05.0-rc4

Description An incorrect permission assignment for a critical resource exists where the file C:ProgramDataLuminalShineconfigapps.json is created by the SYSTEM service. While default Windows C:ProgramData inheritance typically restricts BUILTINUsers to Read and Execute permissions, preventing a standard Elevation of Privilege (EoP) on vanilla installations, a latent gap remains in how permissions are assigned to this resource.

Recommendations Update to version 26.05.0-rc4. Use default condition DACLs (Discretionary Access Control Lists) for ProgramData as a workaround.