Summarize prior to 0.15.1 contains an insecure file permission flaw that occurs during the refresh‑free configuration rewrite; the tool creates a replacement file using the default process umask rather than preserving the original permissions, resulting in the configuration file which stores API keys and provider credentials being readable by any local user on a shared Unix‑like system, thereby disclosing sensitive credentials

Affected product is the open‑source tool Summarize from steipete; all versions older than 0.15.1 are vulnerable, and the flaw applies to any Unix‑style platform where the tool runs

The vulnerability has a CVSS score of 6.8 and is not listed in the CISA KEV catalog; the EPSS score is not available, so exploitation probability cannot be quantified, but because the attack vector requires local user access, any local user on a shared system could read the configuration file and gain secrets, presenting a moderate to high risk if multiple users share the same environment