CVE-2026-78553
Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook
Description
RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access the RansomLook home directory could read the application's cryptographic secret. The exposed key is security-critical because it is used to sign Flask session cookies and is also involved in the legacy API-key key derivation. An attacker who obtains the key can generate valid session cookies and impersonate an authenticated user, including an administrator. In LDAP configurations, exploitation may be particularly straightforward because the session user loader does not require the supplied username to correspond to an existing local user. Successful exploitation requires local access sufficient to read the improperly protected file, but can result in complete compromise of RansomLook's authentication and authorization controls. The patch creates new secret-key files atomically with permissions 0600 and also restricts permissions on existing key files during application startup.
INFO
Published Date :
Aug. 24, 2026, 8:17 p.m.
Last Modified :
Oct. 12, 2026, 9:10 p.m.
Remotely Exploit :
No
Source :
5a6e4751-2f3f-4070-9419-94fb35b644e8
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | 5a6e4751-2f3f-4070-9419-94fb35b644e8 | ||||
| CVSS 4.0 | HIGH | 5a6e4751-2f3f-4070-9419-94fb35b644e8 |
Solution
- Ensure secret key files have 0600 permissions.
- Regenerate the secret key if it was exposed.
- Restrict access to the RansomLook home directory.
- Apply vendor patches for key file handling.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-78553.
| URL | Resource |
|---|---|
| https://github.com/RansomLook/RansomLook/commit/df9d47edcf02dd0125db869d5bc19d93f426d892 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-78553 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-78553
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-78553 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-78553 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 12, 2026
Action Type Old Value New Value Added Translation Title: Ransomlook, Description: RansomLook creó su clave de firma de sesión de Flask sin restringir explícitamente los permisos de archivo. El archivo secret_key fue creado usando los permisos predeterminados y el umask del proceso, resultando en permisos como 0644 bajo un umask común de 022. Consecuentemente, otros usuarios locales capaces de acceder al directorio de inicio de RansomLook podían leer el secreto criptográfico de la aplicación. La clave expuesta es crítica para la seguridad porque se usa para firmar cookies de sesión de Flask y también está involucrada en la derivación de clave de API-key heredada. Un atacante que obtiene la clave puede generar cookies de sesión válidas e impersonar a un usuario autenticado, incluyendo un administrador. En configuraciones LDAP, la explotación puede ser particularmente sencilla porque el cargador de usuarios de sesión no requiere que el nombre de usuario suministrado corresponda a un usuario local existente. La explotación exitosa requiere acceso local suficiente para leer el archivo indebidamente protegido, pero puede resultar en un compromiso completo de los controles de autenticación y autorización de RansomLook. El parche crea nuevos archivos de clave secreta atómicamente con permisos 0600 y también restringe los permisos en archivos de clave existentes durante el inicio de la aplicación. -
New CVE Received by 5a6e4751-2f3f-4070-9419-94fb35b644e8
Aug. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/RansomLook/RansomLook', 'vendor': 'ransomlook', 'product': 'ransomlook', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '2.0.0'}], 'defaultStatus': 'unaffected'}] Added Description RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access the RansomLook home directory could read the application's cryptographic secret. The exposed key is security-critical because it is used to sign Flask session cookies and is also involved in the legacy API-key key derivation. An attacker who obtains the key can generate valid session cookies and impersonate an authenticated user, including an administrator. In LDAP configurations, exploitation may be particularly straightforward because the session user loader does not require the supplied username to correspond to an existing local user. Successful exploitation requires local access sufficient to read the improperly protected file, but can result in complete compromise of RansomLook's authentication and authorization controls. The patch creates new secret-key files atomically with permissions 0600 and also restricts permissions on existing key files during application startup. Added CVSS V4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-276 Added CWE CWE-732 Added Reference https://github.com/RansomLook/RansomLook/commit/df9d47edcf02dd0125db869d5bc19d93f426d892 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 24, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-78553', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-24T20:06:47.525354Z'}