Halloy is an IRC client that stores user credentials in plain text within its configuration files. In versions of Halloy running on Linux and macOS before the commit f180e41061db393acf65bc99f5c5e7397586d9cb, the application creates its config directory and files using the system's default umask. This results in 0644 permissions on files and 0755 on directories, allowing any local user to read the contents of config.toml or any password_file referenced therein. The vulnerability therefore represents a confidentiality breach for local users, exposing potentially sensitive authentication data to the entire local user base.

The affected product is Squidowl Halloy. All Halloy releases on Unix-like systems and macOS that run before the patch commit f180e41061db393acf65bc99f5c5e7397586d9cb are impacted. No specific version numbers are listed in the CNA data; the fix is applied in the mentioned commit or any later releases that include the change.

The CVSS score of 4.8 categorizes the issue as moderate severity, reflecting the local nature of the attack vector. The EPSS score is below 1%, indicating that exploitation is unlikely to occur at scale and there are no publicly known exploits at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to have local access; an attacker could read the default config files, revealing stored credentials. Because the flaw does not impact remote users, the overall risk to environments with strict local user isolation is reduced, but any shared or privileged system remains vulnerable until patched.