CVE-2026-45246 affects the steipete summarize product versions before 0.15.1. The vulnerability is due to incorrect permission assignment during the refresh-free configuration rewrite process. When the configuration file is rewritten, the replacement file is created with default process umask permissions rather than preserving the original file permissions. This misconfiguration exposes sensitive credentials stored in the configuration file to other local users on shared Unix-like systems, potentially leading to unauthorized local access to critical secrets.

Local users on a shared Unix-like system can read sensitive credentials such as API keys and provider credentials from the configuration file due to insecure file permissions. This could lead to unauthorized access or misuse of these credentials. The vulnerability requires local access and does not involve user interaction or network attack vectors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to the system and manually verify and correct file permissions on configuration files after rewrite operations to prevent unauthorized access.