Claude Code versions earlier than 2.1.75 on Windows automatically load a system‑wide configuration file from C:\ProgramData\ClaudeCode\managed-settings.json without verifying the owner or permissions of the directory or file. This flaw, mapped to CWE‑426, allows a local user with standard privileges to add or replace that configuration file. When a victim subsequently launches Claude Code, the malicious configuration file is automatically parsed, which can grant the attacker elevated privileges or enable further exploitation within the application. The vulnerability can compromise confidentiality, integrity, and availability of the local system for the affected account.

Anthropic’s Claude Code running on Windows machines with a shared multi‑user environment. Versions prior to 2.1.75 are vulnerable; the issue has been fixed starting with 2.1.75. The vulnerability stems from the default path C:\ProgramData\ClaudeCode, which exists or may be created by non‑administrative users.

The CVSS score of 5.4 indicates moderate severity. EPSS data is not available, so the current likelihood of exploitation is unclear, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack scenario requires a user who shares a Windows machine and can write to the ProgramData directory to drop a crafted configuration file. The victim user must then launch Claude Code after the malicious file is in place. This chain of events suggests that exploitation is feasible on a shared workstation or workstation with multiple local accounts.