CVE-2026-45246 Details

A vulnerability exists in Steipete Summarize versions prior to 0.15.1, where the refresh-free configuration rewrite process does not properly manage file permissions. This flaw allows local users to access sensitive credentials by taking advantage of default filesystem permission settings. When the refresh-free path updates the configuration file, it applies the default process umask permissions instead of maintaining the original file permissions. As a result, the configuration file, which contains API keys and provider credentials, is exposed to other local users on shared Unix-like systems.

Users can upgrade to Steipete Summarize version 0.15.2 or later, where this vulnerability has been addressed.