Improper File Permissions in RansomLook Allows Local Users to Access Sensitive Data

CVE-2026-78553

What is CVE-2026-78553?

RansomLook has a security issue that results from the creation of its Flask session-signing key without adequate file permission restrictions. This oversight allows local users with access to the RansomLook home directory to read the application's sensitive cryptographic secret, represented by a poorly secured secret_key file. This key is crucial for signing session cookies and plays a key role in deriving legacy API keys. If an attacker gains access to this key, they can generate valid session cookies and impersonate authenticated users, including administrators. This exploit is particularly easy in systems configured with LDAP, as the session user loader does not require the provided username to correspond with an existing local user account. Acquiring local access to read the inadequately protected file can therefore lead to a complete breach of RansomLook's authentication and authorization systems. A patch has been implemented that enhances security by creating new secret-key files with restricted permissions and adjusting existing key file permissions during startup.

References