CVE-2026-59292: CWE-732 Incorrect Permission Assignment for Critical Resource in Spring Spring Integration

The vulnerability identified as CVE-2026-59292 involves the PropertiesPersistingMetadataStore component in Spring Integration, which persists its state to a file located at ${java.io.tmpdir}/spring-integration/metadata-store.properties. This file is created with world-readable permissions, constituting an incorrect permission assignment (CWE-732). This could allow unauthorized local users to read potentially sensitive metadata stored by the application. The affected versions include Spring Integration 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The CVSS 3.1 base score is 3.2, indicating low severity, with an attack vector of local access, low complexity, and requiring high privileges. There is no vendor advisory or patch information available at this time.

The impact is limited to unauthorized local users potentially reading the metadata stored in the file due to world-readable permissions. This could lead to information disclosure of metadata state persisted by Spring Integration. There is no indication of integrity or availability impact. The vulnerability requires local access and high privileges to exploit, reducing its overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the temporary directory or the specific metadata-store.properties file to prevent unauthorized local access. Monitoring and controlling local user permissions can help mitigate exposure.