The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically 0644. As a result any user on a multi‑user system can read the stdout/stderr captured by nohup, potentially exposing sensitive data. This divergence from the behavior of GNU coreutils, which restricts nohup.out to 0600, represents an information disclosure flaw classified as CWE‑732.

The flaw affects the uutils coreutils package, specifically the nohup component. No particular versions were listed, so any installation of this package that relies on the default nohup behavior is vulnerable. The impact is relevant in any environment where multiple users share a system and use nohup to run commands that produce output.

The CVSS score of 3.3 indicates a low severity vulnerability, and the EPSS score is not available, suggesting limited evidence of attack activity. The vulnerability is not listed in CISA KEV, further supporting a low exploitation likelihood. The attack vector is local; any user with the ability to run a command under nohup could read the generated nohup.out file and recover whatever data was written to stdout or stderr.