What is the CVSS score of CVE-2026-32810?

CVE-2026-32810 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-32810?

Organizations using Rust. In should be aware of moderate risk from CVE-2026-32810, a incorrect permissions vulnerability rated CVSS 5.5. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-32810?

Within 30 days: Identify affected systems running Rust. In and apply vendor patches as part of regular patch cycle. Review and tighten file/resource permissions.

macOS CVE-2026-32810

MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-03-20 GitHub_M

Information Disclosure Apple macOS Suse

5.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 23:01 vuln.today

CVE Published

Mar 20, 2026 - 22:40 nvd

MEDIUM 5.5

DescriptionGitHub Advisory

Halloy is an IRC application written in Rust. In versions on \*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its config directory and files using default umask permissions, which typically results in 0644 on files and 0755 on directories. This allows any local user on the system to read plaintext credentials stored in config.toml or referenced password_file paths. Commit f180e41061db393acf65bc99f5c5e7397586d9cb patches the issue.

AnalysisAI

Halloy, an IRC application written in Rust, fails to properly restrict file permissions on its configuration directory and files on *nix and macOS systems prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, resulting in world-readable access to plaintext credentials. Any local user on an affected system can read sensitive authentication data stored in config.toml or referenced password files, leading to credential compromise. While no CVSS score or EPSS data is currently available, the vulnerability represents a direct information disclosure risk with low exploitation complexity.

Technical ContextAI

Halloy is a Rust-based IRC client (CPE: cpe:2.3:a:squidowl:halloy:*:*:*:*:*:*:*:*) that stores configuration data including plaintext credentials in user-accessible directories. The vulnerability stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), where the application relies on default system umask settings rather than explicitly enforcing restrictive file permissions. On typical Unix-like systems, default umask results in file permissions of 0644 (readable by all users) and directory permissions of 0755 (traversable and readable by all users). This is a common misconfiguration in multi-user environments where local privilege separation is essential, and the Rust standard library and file I/O operations do not automatically enforce tighter permissions without explicit developer intervention.

RemediationAI

Update Halloy to a version released after commit f180e41061db393acf65bc99f5c5e7397586d9cb, which patches the permission assignment issue by explicitly setting restrictive file and directory permissions during creation. Refer to the vendor security advisory at https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g and https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cb for exact patched versions and deployment guidance. As an interim workaround on affected systems, manually restrict permissions on the Halloy config directory (typically ~/.config/halloy or similar) to 0700 (owner-only access) and all files within to 0600 using chmod commands; however, this must be applied manually after each configuration change and is not a permanent fix. The preferred and definitive remedy is to upgrade to the patched version.