Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook

published 2026-08-24 2 mo ago modified 2026-10-12 27 d ago also EUVD-2026-65089

cvss: 7.0; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits: 0; none known

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access the RansomLook home directory could read the application's cryptographic secret.

The exposed key is security-critical because it is used to sign Flask session cookies and is also involved in the legacy API-key key derivation. An attacker who obtains the key can generate valid session cookies and impersonate an authenticated user, including an administrator. In LDAP configurations, exploitation may be particularly straightforward because the session user loader does not require the supplied username to correspond to an existing local user.

Successful exploitation requires local access sufficient to read the improperly protected file, but can result in complete compromise of RansomLook's authentication and authorization controls.

The patch creates new secret-key files atomically with permissions 0600 and also restricts permissions on existing key files during application startup.

Patch / fix

links 1

github.com/RansomLook/RansomLook@df9d47e commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-08-24)

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	7.0	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CNA	4.0	7.0	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

ransomlook ransomlook

Classification

Weakness

CWE-276 Incorrect Default Permissions
CWE-732 Incorrect Permission Assignment for Critical Resource

References

github.com /RansomLook/RansomLook/commit/df9d47edcf02dd0125db869d5bc19d93f426d892
patch

Sources

CVE List CVE-2026-78553
NVD CVE-2026-78553

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary