LuminalShine
CVE-2026-50544
MEDIUM
Severity by source
AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Local-only attack; AC:H for required non-default ACL misconfiguration; PR:L reflects standard-user exploitation path escalating to SYSTEM; UI:R for service reload trigger requirement.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at src/platform/windows/misc.cpp lives at C:\ProgramData\LuminalShine\config\apps.json and is created by the SYSTEM service. Under Windows' default C:\ProgramData inheritance, that gives BUILTIN\Users only Read+Execute - not writable - so the canonical EoP doesn't actually trigger on a vanilla install. Version 26.05.0-rc4 contains a patch for the issue. As a workaround, use default condition DACLs for ProgramData.
AnalysisAI
Privilege escalation in LuminalShine prior to version 26.05.0-rc4 stems from a latent file permission gap where apps.json, written by the SYSTEM service to C:\ProgramData\LuminalShine\config\, could be overwritten by local users if directory ACLs deviate from Windows defaults. On a default Windows installation this EoP path does not trigger because BUILTIN\Users inherits only Read+Execute rights from C:\ProgramData; the vulnerability is only exploitable when an administrator has loosened those inherited permissions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent non-default conditions: first, the ACLs on C:\ProgramData or C:\ProgramData\LuminalShine\config\ must have been modified to grant write access to BUILTIN\Users or equivalent low-privilege accounts, which is explicitly not the case on a default Windows installation; second, the attacker must have local access to the target system. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.3 with vector AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H appropriately reflects the constrained exploitation conditions: local access only, high attack complexity, high privileges required, and mandatory user interaction all narrow the practical attack window considerably. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade LuminalShine to version 26.05.0-rc4 or later, which contains a patch for this issue as confirmed by the GitHub Security Advisory GHSA-52q6-5x97-2747 (https://github.com/NortheBridge/luminalshine/security/advisories/GHSA-52q6-5x97-2747). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today