Briefcase versions from 0.3.0 to before 0.3.26 have a vulnerability (CWE-732) related to incorrect permission assignment for critical resources during MSI installer creation for Windows projects installed per-machine. The installer creates a directory inheriting parent directory permissions, which may allow low-privileged authenticated users to replace or modify application binaries. This can lead to privilege escalation if an administrator executes the tampered binary. The root cause is the template used to generate the WXS file. The vulnerability was fixed in briefcase 0.3.26 and later by updating the WXS templates. Remediation involves regenerating the WXS file with updated templates or applying the patch manually to existing WXS files.

An attacker with low privilege but authenticated access on a Windows system where an affected briefcase-generated MSI installer is used can modify installed application binaries due to improper directory permissions. This modification can lead to privilege escalation if an administrator runs the altered binary, resulting in full system compromise. The vulnerability affects installations scoped to all users (per-machine).

A fix is available in beeware briefcase versions 0.3.26, 0.4.0, and 0.4.1, which include updated WXS templates correcting the permission assignment issue. Users should upgrade to one of these versions and re-run `briefcase create` to regenerate the installer templates. For existing WXS files generated by briefcase 0.3.24 or later, the patch can be manually applied to correct the permissions. No vendor advisory was provided, so check the official beeware documentation or repository for the patch details and instructions.