# CVE-2026-45246: steipete Summarize insecure file permissions in refresh-free path

Source: https://junglewise.ai/threats/cve-2026-45246-steipete-summarize-insecure-file-permissions-in-refresh-free-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-18. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-45246 · Severity: medium · CVSS 5.5 · Published 2026-05-18

Summarize is a tool used for generating content summaries. A security flaw in how it updates its configuration file allows other users on the same computer to read sensitive information, such as API keys and service credentials. This occurs because the software fails to maintain private file permissions when rewriting its settings, potentially leading to unauthorized access to the user's connected AI provider accounts.

Technologies: [Steipete Summarize](https://junglewise.ai/threats/technologies/summarize). Vendors: [Steipete](https://junglewise.ai/threats/vendors/steipete).

## Quick answers

**Is CVE-2026-45246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45246 being exploited in the wild.

**How severe is CVE-2026-45246?** Medium severity, with a CVSS score of 5.5, published 18 May 2026.

**Which products and versions are affected?** Steipete Summarize < 0.15.1.

**Is there a fix for CVE-2026-45246?** A patch was published on 2026-05-14: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45246 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-45246?** Check whether you run Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An insecure file permission vulnerability (CWE-732) exists in Summarize versions prior to 0.15.1 within the 'refresh-free' configuration rewrite path. When updating the configuration file (~/.summarize/config.json), the application creates a temporary replacement file using default process umask permissions instead of preserving the original file's restrictive permissions. On shared Unix-like systems with a typical 022 umask, this results in the configuration file becoming world-readable. An attacker with local shell access can exploit this to read sensitive API keys and provider credentials stored in the config. The issue was fixed in version 0.15.1 (and subsequent release 0.15.2) by explicitly setting directory permissions to 0700 and file permissions to 0600 during the rewrite process.

## Affected products

- steipete Summarize < 0.15.1

## Timeline

- 2026-05-12: other: Pull request submitted to fix the vulnerability
- 2026-05-14: patched: Fix merged into main branch
- 2026-05-17: advisory: Version 0.15.2 released with security fixes
- 2026-05-18: disclosed: CVE-2026-45246 published

## References

- [https://github.com/steipete/summarize/commit/9e990193650a23dab73f37d5e1964d574a44098b](https://github.com/steipete/summarize/commit/9e990193650a23dab73f37d5e1964d574a44098b)
- [https://github.com/steipete/summarize/pull/217](https://github.com/steipete/summarize/pull/217)
- [https://github.com/steipete/summarize/releases/tag/v0.15.2](https://github.com/steipete/summarize/releases/tag/v0.15.2)
- [https://www.vulncheck.com/advisories/summarize-insecure-file-permissions-information-disclosure](https://www.vulncheck.com/advisories/summarize-insecure-file-permissions-information-disclosure)

## Related threats

- [steipete Summarize SSRF in podcast RSS transcript fetching](https://junglewise.ai/threats/cve-2026-53782-steipete-summarize-ssrf-in-podcast-rss-transcript-fetching)
- [steipete summarize disk exhaustion via uncapped media download](https://junglewise.ai/threats/cve-2026-53781-steipete-summarize-disk-exhaustion-via-uncapped-media-download)
- [steipete Summarize SSRF via synthetic mouseover events](https://junglewise.ai/threats/cve-2026-45245-steipete-summarize-ssrf-via-synthetic-mouseover-events)
- [steipete Summarize missing authorization in browser automation](https://junglewise.ai/threats/cve-2026-45244-steipete-summarize-missing-authorization-in-browser-automation)
- [steipete Summarize missing authorization in content script bridge](https://junglewise.ai/threats/cve-2026-45243-steipete-summarize-missing-authorization-in-content-script-bridge)