RansomLook EUVD-2026-65089

The attacker must hold a local OS user account on the host running RansomLook and must be able to read files within the RansomLook home directory. The vulnerable condition is the existence of a secret_key file with permissions broader than 0600 - specifically 0644 under the standard 022 umask - which is present in all deployments created before the patch. No network-level access to the application, no RansomLook credentials, and no elevated OS privileges are required to read the file. In LDAP authentication mode, exploitation imposes no additional conditions: the session user_loader does not check that the username embedded in the forged cookie corresponds to any real account, so the attacker may claim administrator identity using a completely invented username string. Exploitation is limited by: (1) requiring a local shell account on the specific host; (2) requiring the RansomLook home directory to be traversable by the attacker's user - deployments where the home directory is mode 0700 or 0750 owned by a dedicated service account prevent access entirely; and (3) in non-LDAP mode, the forged username must correspond to a valid local RansomLook user, adding modest knowledge requirements.

The CVSS 4.0 score of 7.0 (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) reflects a local-only attack that nonetheless yields high confidentiality impact. The local attack vector substantially constrains the exposed population to users holding OS-level shell access on the RansomLook host, which is the primary limiting factor. Within that scope, complexity is genuinely low: reading a 0644 file requires no tooling or exploitation primitives. The VC:H metric is fully justified - the session key is the single cryptographic trust anchor for the entire application. LDAP deployments face an additive risk: the session user loader does not validate that a forged username exists, making administrator impersonation unconditional once the key is obtained. This vulnerability is not listed in CISA KEV and no POC has been identified, keeping real-world exploitation probability low given the product's limited footprint. EPSS data was not provided in the input. The gap between a 7.0 CVSS and practical risk is real: organizations running RansomLook on a dedicated single-tenant host with the service account's home directory not accessible to other local users are not meaningfully exposed; shared multi-user environments represent the highest-risk deployment pattern.

A non-privileged local user on the RansomLook host lists the application home directory and reads the world-readable secret_key file (permissions 0644). Using the 64-byte secret, the attacker constructs and signs a Flask session cookie containing the username 'admin' (or any arbitrary string in LDAP mode) and submits it to the RansomLook web interface, which cryptographically validates the signature and grants full administrator access without any password check.