EUVD-2026-96365
GHSA-29j6-3xvc-79ff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local unprivileged account on host
-
ExploitList world-readable genoffice-mcp-http temp directory
-
ImpactRead staged uploads and converted outputs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Exploitation Conditions | Requires (1) the GenOffice HTTP MCP server running on the host, which stages client uploads and converted outputs in a genoffice-mcp-http directory under the system temp directory with world-readable permissions, and (2) a local unprivileged user account on that same host. The HTTP bearer token provides no protection because access occurs at the filesystem layer, not over HTTP. Limiting factors: there is NO remote vector (local access mandatory), no privilege escalation or data modification is possible (read-only, confidentiality only), exposure is bounded to files currently staged in the temp directory, and single-user deployments where no other local account exists are effectively not exploitable. |
| Impact | This is a genuine but moderate-severity, low-urgency issue - not a top priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H) correctly frames it as a LOCAL confidentiality-only flaw: an attacker already needs an unprivileged account on the same host running the GenOffice HTTP MCP server, and impact is limited to reading staged files (VI:N/VA:N). No EPSS score was provided, there is no CISA KEV listing (not actively exploited), and no public exploit code was identified, though full technical details and the exact vulnerable source lines are publicly disclosed (VulnCheck advisory + hackmd writeup + GitHub files.ts#L70-L90), which lowers the barrier to writing a trivial PoC (a directory listing). The 'Authentication Bypass' framing is somewhat generous: the root cause is CWE-732 incorrect permission assignment (a world-readable temp directory), and the bearer-token 'bypass' is incidental - a local reader never touches the HTTP layer. Signals are internally consistent: a local-only vector with no active-exploitation evidence means real-world risk is confined to multi-user/shared hosts and is low where the MCP server runs on single-user developer machines. |
| Exploit ScenarioDerived | On a shared or multi-user host where GenOffice's HTTP MCP server is running, a local unprivileged user navigates to the system temporary directory and lists the world-readable genoffice-mcp-http folder. They directly read other users' uploaded source documents and AI-converted outputs from disk, never needing the HTTP bearer token. No public exploit code is identified, but full technical details are published and exploitation requires only a standard directory listing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Local unprivileged users on a host running GenOffice's HTTP MCP server can read other users' uploaded documents and AI-converted outputs, because every version through 0.11.505 stages those files in a genoffice-mcp-http directory under the system temporary directory with world-readable permissions. The HTTP bearer token is irrelevant to the attack: an attacker simply lists and opens the temp-directory contents at the filesystem layer, so the bearer token that normally guards the MCP HTTP endpoint provides no protection at all. The issue is strictly local (CVSS 4.0 score 6.8, AV:L/PR:L with high confidentiality impact and no integrity or availability impact), read-only, and bounded to files currently staged in the temp directory; no public exploit code or active exploitation has been identified at time of analysis, and single-user hosts with no other local accounts are effectively not exploitable.
RemediationAI
No vendor-released patch identified at time of analysis: version 0.11.505 is the highest affected release referenced in the advisory, and neither the vendor advisory nor the linked release notes publish a fixed build for this specific issue, so treat any upgrade as unverified until the vendor ships a release that creates the MCP artifact store with 0700/0600 permissions or relocates it to a per-process private directory. Until such a fix is confirmed, apply compensating controls and accept their trade-offs: (1) run the MCP HTTP server with a restrictive umask (for example umask 077) so newly created temp files and the genoffice-mcp-http directory are owner-only, which can break workflows or sibling tools that legitimately expect shared temp access; (2) point the server at a private per-user temp root via TMPDIR and pre-create it with mode 0700, or run the service under systemd with PrivateTmp=true so its /tmp is namespaced, at the cost of losing visibility of files produced by other processes outside the namespace; (3) tighten the existing directory before and during operation (chmod 0700 on the genoffice-mcp-http directory and chmod 600 on its contents) and enforce this with a startup hook or a periodic permission check, since default temp cleanup on some platforms may reset modes; (4) run the HTTP MCP server under a dedicated service account and restrict or remove other local interactive accounts on the host, which limits the pool of possible readers but is impractical on shared workstations; and (5) disable or stop the MCP HTTP server when it is not in active use, which eliminates the exposure window entirely at the cost of functionality. Note that rotating or strengthening the HTTP bearer token does not mitigate this issue, because the exploit path is filesystem-based; instead, treat any uploads and generated outputs already staged in the shared temp directory as potentially disclosed and rotate or re-protect the underlying sensitive content accordingly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GenOffice is a Genspark AI office/document suite that ships a CLI and a Model Context Protocol (MCP) HTTP server (source at packages/cli/src/mcp/files.ts, lines 70-90). The MCP server is designed to accept client uploads and to write converted/generated outputs to disk so they can be handed off to MCP tools; it stages these artifacts in a directory named genoffice-mcp-http under the operating system's temporary directory (for example /tmp/genoffice-mcp-http on macOS/Linux). The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource): the directory and its files are created with permissions that make them readable (and listable) by any local account, most likely because the server inherits the process umask or explicitly applies world-readable modes such as 0755/0644 instead of 0700/0600. Because the artifact store is a filesystem resource rather than an HTTP resource, the bearer token enforced on the HTTP MCP transport does not gate access to it, so the token cannot compensate for the permissive file modes. Any local user who can enumerate the system temp directory can therefore read confidential client uploads and their converted derivatives for as long as they remain staged there.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Local unprivileged account required to read world-readable temp files, so AV:L and PR:L; trivial directory listing gives AC:L; confidentiality-only exposure sets C:H, I:N, A:N.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to read client uploads and converted outputs, bypassing the HTTP bearer token.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB