Insecure File Permissions in Summarize Daemon Configuration on Unix-like Systems

CVE-2026-45222

What is CVE-2026-45222?

The Summarize application exposes its daemon configuration file with overly permissive filesystem settings, particularly on Unix-like systems. Specifically, versions up to 0.14.1 allow local attackers to access the configuration directory and read sensitive information such as bearer tokens and API credentials stored in the file ~/.summarize/daemon.json. This flaw creates a significant risk, as malicious users can potentially exploit these permissions to gain unauthorized access to the daemon or extract sensitive API keys, undermining the security of the application.

References