# CVE-2026-78553: RansomLook insecure Flask session key file permissions

Source: https://junglewise.ai/threats/cve-2026-78553-ransomlook-insecure-flask-session-key-file-permissions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78553 · Severity: info · Published 2026-08-24

RansomLook is a web application for tracking ransomware incidents. The application creates a cryptographic secret key used for signing user session cookies with overly permissive file permissions (0644 instead of 0600), allowing any local user on the system to read it. An attacker with local access can use this key to forge valid session cookies, impersonate legitimate users including administrators, and gain complete control over the application's authentication system.

Technologies: [RansomLook](https://junglewise.ai/threats/technologies/ransomlook). Vendors: [RansomLook](https://junglewise.ai/threats/vendors/ransomlook).

## Quick answers

**Is CVE-2026-78553 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78553 being exploited in the wild.

**How severe is CVE-2026-78553?** Informational severity, published 24 August 2026.

**Which products and versions are affected?** RansomLook RansomLook.

**Is there a fix for CVE-2026-78553?** A patch was published on 2026-08-24: Patch released in commit df9d47e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78553 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2026-78553?** Check whether you run RansomLook. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an insecure file permissions vulnerability affecting the Flask session-signing key file. The secret_key file is created with default process umask (typically resulting in 0644 permissions) rather than restrictive permissions (0600), making it readable by any local user. The exposed key is cryptographic material used to sign Flask session cookies and derive legacy API keys. An attacker with local file-system access can read the key and generate valid session cookies to impersonate any user, including administrators. In LDAP authentication configurations, exploitation is particularly easy because the session loader accepts usernames that do not correspond to local users. A patch has been released that creates new key files atomically with 0600 permissions and restricts permissions on existing files during startup.

## Affected products

- RansomLook RansomLook

## Timeline

- 2026-08-24: disclosed
- 2026-08-24: patched: Patch released in commit df9d47e

## References

- [https://github.com/RansomLook/RansomLook/commit/df9d47edcf02dd0125db869d5bc19d93f426d892](https://github.com/RansomLook/RansomLook/commit/df9d47edcf02dd0125db869d5bc19d93f426d892)

## Related threats

- [RansomLook API key exposure in HTML source](https://junglewise.ai/threats/cve-2026-78555-ransomlook-api-key-exposure-in-html-source)
- [RansomLook authentication endpoint enumeration and DoS](https://junglewise.ai/threats/cve-2026-78551-ransomlook-authentication-endpoint-enumeration-and-dos)
- [RansomLook API information disclosure via unauthenticated location records](https://junglewise.ai/threats/cve-2026-78386-ransomlook-api-information-disclosure-via-unauthenticated)
- [RansomLook insufficient resource validation in PDF generation](https://junglewise.ai/threats/cve-2026-78385-ransomlook-insufficient-resource-validation-in-pdf-generation)
- [RansomLook Redis glob pattern injection](https://junglewise.ai/threats/cve-2026-78378-ransomlook-redis-glob-pattern-injection)