The flaw concerns the way NortheBridge’s LuminalShine assigns permissions to a critical configuration file. When the program is installed with default settings, the SYSTEM service creates C:\\ProgramData\\LuminalShine\\config\\apps.json but the resulting permission set gives BUILTIN\\Users read‑execute only. This mis‑assignment opens a path for local users to tamper with a crucial resource or create a temporary file in an insecure directory, potentially enabling privilege escalation or injection of malicious content. The weakness is mapped to CWE-379 (Permission Check Design Flaw) and CWE-732 (Incorrect Permission Assignment).

NortheBridge LuminalShine versions prior to 26.05.0-rc4 running on Windows with the default ProgramData location are affected. The standard installer places the critical file in C:\\ProgramData\\LuminalShine\\config, and the issue applies to all installations that use the default permission hierarchy.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, so the public exploit expectation is low. The attack vector is local, requiring that the attacker control a user account with the ability to interact with the installed instance of LuminalShine. The problem arises from the incorrect permission assignment of a system‑created file; once the file is writable, an attacker could overwrite it or drop a malicious payload, thereby gaining escalated privileges or injecting code. A patch is available in version 26.05.0-rc4, and a temporary workaround involves resetting the default permission set of the ProgramData directory.