CVE-2026-76159
Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file.
Scoring
- Severity
- HIGH
- CVSS base score
- 7
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.10%
- CWE
- CWE-732
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- Duplicati Duplicati
Weakness type
Related vulnerabilities
- CVE-2025-14988 — Incorrect Permission Assignment for Critical Resource vulnerability in iba Systems ibaPDA
- CVE-2026-21902 — Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root
- CVE-2026-29188 — File Browser: TUS Delete Endpoint Bypasses Delete Permission Check
- CVE-2026-25770 — Wazuh has Privilege Escalation to Root via Cluster Protocol File Write
- CVE-2026-21765 — HCL BigFix Platform is affected by insecure permissions on private cryptographic keys
- CVE-2025-13941 — Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability
- CVE-2021-47742 — Epic Games Psyonix Rocket League <=1.95 Elevation of Privileges via Insecure Permissions
- CVE-2020-36938 — WinAVR Version 20100110 - Insecure Folder Permissions