The vulnerability identified as CVE-2026-50544 affects NortheBridge luminalshine prior to version 26.05.0-rc4. It is a CWE-379 (Creation of Temporary File in Directory with Insecure Permissions) and CWE-732 issue. The problem arises because the file apps.json is created by the SYSTEM service in a directory where permissions could allow unauthorized modification. However, on a default Windows installation, the ProgramData directory's inherited permissions grant BUILTIN\Users only Read and Execute rights, not write, which prevents exploitation of the elevation of privilege scenario. The vendor patched this issue in version 26.05.0-rc4. The vulnerability has a CVSS 3.1 score of 6.3, indicating medium severity, with attack vector local, high attack complexity, high privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

If exploited, this vulnerability could allow a local attacker with high privileges and user interaction to gain elevated privileges by modifying a temporary file created with insecure permissions. However, the default Windows permissions on the ProgramData directory mitigate this risk on a vanilla install. The impact includes potential full compromise of confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild.

A patch is available in NortheBridge luminalshine version 26.05.0-rc4 that addresses this issue. Users should upgrade to this version or later. As a workaround, administrators can ensure that the ProgramData directory uses default discretionary access control lists (DACLs) to prevent unauthorized write access. Since the default Windows permissions already mitigate the canonical elevation of privilege, no urgent action is required if the system is in a default configuration.