LuminalShine CVE-2026-50544

Exploitation requires two concurrent non-default conditions: first, the ACLs on C:\ProgramData or C:\ProgramData\LuminalShine\config\ must have been modified to grant write access to BUILTIN\Users or equivalent low-privilege accounts, which is explicitly not the case on a default Windows installation; second, the attacker must have local access to the target system. CVSS PR:H indicates high privileges are required per the scoring model, and UI:R means user interaction - such as triggering the service to process the modified configuration - is needed. The attack vector is strictly local (AV:L) with high complexity (AC:H). The canonical EoP path does not function on vanilla Windows because the inherited C:\ProgramData ACL restricts standard users to Read+Execute only; write access must have been explicitly granted by an administrator for this vulnerability to be exploitable.

The CVSS 3.1 score of 6.3 with vector AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H appropriately reflects the constrained exploitation conditions: local access only, high attack complexity, high privileges required, and mandatory user interaction all narrow the practical attack window considerably. The most important signal in this CVE is the description's own admission that the canonical EoP does not trigger on a vanilla Windows install, meaning real-world risk is entirely conditional on a non-default ACL misconfiguration - even a mid-sized municipal IT team in boleslawiec running standard Windows domain policy would be protected without any additional action. EPSS data is not provided in the available intelligence; given the niche product footprint and the necessity of non-default permissions, exploitation probability is assessed as low. No KEV listing and no POC are identified, further reducing urgency. The C:H/I:H/A:H triple suggests severe impact if fully exploited, but those impacts are gated behind the high-complexity, non-default-configuration prerequisites - making this a conditional risk rather than an immediate priority for most organizations.

An attacker with local access to a Windows system where C:\ProgramData ACLs have been loosened to grant standard users write access to the LuminalShine config directory could overwrite apps.json with a malicious configuration. When the SYSTEM service subsequently processes the tampered file, the attacker achieves SYSTEM-level privilege escalation. No public POC has been identified, and this scenario requires a non-default ACL configuration to be viable.