CVE-2026-9651
Description
CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account compromise when an attacker with privileged local access reads improperly protected system files.
Summary dbcve.org
This is a CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerability where system files containing password hashes have overly permissive access controls. An attacker with privileged local access can read these improperly protected files, exposing password hashes that could be cracked for account compromise.
Mitigation
Restrict file permissions on password hash files to only allow read access by privileged system accounts (e.g., root), removing all access for non-admin users and groups. Verify the fix by attempting to read the files as a non-privileged user.