CVE-2026-78553
Received Received - Intake

Information Disclosure in RansomLook Flask Session Key

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: CIRCL

Description
RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access the RansomLook home directory could read the application's cryptographic secret. The exposed key is security-critical because it is used to sign Flask session cookies and is also involved in the legacy API-key key derivation. An attacker who obtains the key can generate valid session cookies and impersonate an authenticated user, including an administrator. In LDAP configurations, exploitation may be particularly straightforward because the session user loader does not require the supplied username to correspond to an existing local user. Successful exploitation requires local access sufficient to read the improperly protected file, but can result in complete compromise of RansomLook's authentication and authorization controls. The patch creates new secret-key files atomically with permissions 0600 and also restricts permissions on existing key files during application startup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-25
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78553
EUVD
EUVD-2026-65089

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ransomlook ransomlook *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-276 During installation, installed file permissions are set to allow anyone to modify those files.
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RansomLook created its Flask session-signing key with default file permissions (e.g., 0644) due to an improper umask setting. This allowed other local users to read the secret key file, which is critical for signing session cookies and deriving API keys.

Detection Guidance

Check for Flask session-signing key files with overly permissive permissions (e.g., 0644) in RansomLook's home directory. Use commands like 'find / -type f -name "secret_key*" -perm 0644 2>/dev/null' to locate such files.

Impact Analysis

An attacker with local access could read the exposed key and generate valid session cookies to impersonate any user, including administrators. This could lead to unauthorized access, data theft, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to potential data breaches and lack of proper access controls.

Mitigation Strategies

Apply the patch that creates new secret-key files with permissions 0600. Restrict permissions on existing key files to 0600 using 'chmod 0600 <key_file>'. Ensure no unauthorized users have access to the RansomLook home directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78553. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart