CVE-2026-78553

Name of the Vulnerable Software and Affected Versions RansomLook (affected versions not specified)

Description The application creates its Flask session-signing key without explicitly restricting file permissions, often resulting in permissions like 0644. This allows local users with access to the home directory to read the secret key file. This cryptographic secret is used to sign Flask session cookies and for legacy API-key key derivation. An attacker with this key can generate valid session cookies to impersonate authenticated users, including administrators. In LDAP configurations, this is simplified as the session user loader does not verify if the username corresponds to an existing local user. Successful exploitation requires local file system access and can lead to a complete compromise of authentication and authorization controls.

Recommendations Update the software to the patched version that creates secret-key files with 0600 permissions and restricts permissions on existing key files during startup. Restrict local access to the RansomLook home directory to prevent unauthorized users from reading the secret key file.