CVE-2026-78553 - Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook
Brief
CVE ID : CVE-2026-78553
Published : Aug. 24, 2026, 8:17 p. m.
- 54 minutes ago
Description : RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access the RansomLook home directory could read the application's cryptographic secret.
The exposed key is security-critical because it is used to sign Flask session cookies and is also involved in the legacy API-key key derivation. An attacker who obtains the key can generate valid session cookies and impersonate an authenticated user, including an administrator.