Description
Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file.
Published: 2026-09-15
Score: 7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://zuso.ai/advisory/ cve-icon cve-icon
History

Tue, 15 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Duplicati
Duplicati duplicati
Vendors & Products Duplicati
Duplicati duplicati

Tue, 15 Sep 2026 09:00:00 +0000

Type Values Removed Values Added
Description Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file.
Title Duplicati for Windows - Incorrect Permission Assignment for Critical Resource
Weaknesses CWE-732
References
Metrics cvssV4_0

{'score': 7, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Duplicati Duplicati
cve-icon MITRE

Status: PUBLISHED

Assigner: ZUSO ART

Published:

Updated: 2026-09-15T08:49:12.313Z

Reserved: 2026-08-19T08:03:53.871Z

Link: CVE-2026-76159

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-15T09:16:43.900

Modified: 2026-09-15T09:16:43.900

Link: CVE-2026-76159

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T10:30:12Z

Weaknesses
  • CWE-732

    Incorrect Permission Assignment for Critical Resource