CVE-2026-80432 is a missing authorization vulnerability (CWE-862) in the drag and drop handling of kitty terminal emulator versions >=0.47.0 and <0.49.0. The flaw arises because drop_enqueue_request() in kitty/dnd.c serves drag data requests without checking if a drop has actually occurred, allowing a client to obtain file contents merely by hovering files over the window. Additionally, drop_left_child() improperly retains state and file handles after a drag leaves the window without a drop, enabling continued unauthorized reading of file contents. The kitty process reads the file contents from the filesystem using paths offered by the drag source, leading to disclosure of file contents without explicit user consent.

An attacker with the ability to write to the terminal can obtain the contents of files dragged over the kitty window without the user completing the drop action. This leads to unauthorized disclosure of potentially sensitive file contents. The vulnerability requires local access to the terminal and user interaction (dragging files over the window), but does not require privilege escalation or user confirmation of the drop.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running untrusted programs that can write to the kitty terminal and avoid dragging files over kitty windows when untrusted clients are connected.