CVE-2026-32684

Vulnerability

Overview

The application does not enforce strict directory access permissions, leaving sensitive files potentially accessible to other malicious applications installed on the same system. This flaw arises from inadequate access control mechanisms for local storage directories.

Exploitation

Conditions

To exploit this vulnerability, an attacker would need to have a malicious application installed on the same device. No elevated privileges or network access are required beyond local execution. The attack surface is limited to local applications, reducing the overall risk.

Potential

Impact

A successful exploit could allow the malicious application to read sensitive information stored in directories that should be protected, such as configuration files, logs, or user data. The severity is low (CVSS 2.9) due to the prerequisite of local access and the limited scope of information disclosure.

Mitigation

The vendor has released version V6.12.0 (Team Mode) which may address this issue, as indicated in the official changelog [1]. Users are advised to update to the latest version to ensure proper directory access restrictions are in place.