Executive brief
Bizerba BRAIN2 software contains a configuration error that grants all users on a Windows system full control over the shared ProgramData folder. This folder is typically used by many different applications to store sensitive configuration and operational data. An attacker with local access to the machine could modify or delete files belonging to other programs, potentially leading to system instability, data loss, or unauthorized access to other software services.
Technical details
A vulnerability classified as Incorrect Default Permissions (CWE-276) exists in the BRAIN2 setup process. During installation, the LogPathConfig.exe utility is executed, which mistakenly applies 'Full Control' permissions for the 'Everyone' group to the root %ProgramData% directory instead of the specific %ProgramData%\Bizerba\BRAIN2\ subdirectory. This allows any local user to read, write, or delete files across the entire ProgramData volume, potentially impacting other installed applications. The issue was addressed in BRAIN2 version 3.09 by removing the tool from the main setup, though it remained in the Bizerba ScriptService until its planned removal in version 3.11.
Affected products
- Bizerba SE & Co. KG BRAIN2 versions prior to 3.09; Bizerba ScriptService component prior to 3.11
Timeline
- 2026-07-20: advisory: Initial publication of CVE-2026-16246