The vulnerability stems from an incorrect ownership setting in the mise binary when installed via the root account. The tarball contents assign the executable mise/bin/mise the user and group ID 1001. During unpacking, the installer does not correct these ownerships, which allows a local user whose UID or GID matches 1001 to overwrite the binary. Once replaced, that user can introduce malicious code that will run with root privileges because the executable is owned by a privileged account after installation. This flaw falls under CWE‑278 and enables privilege escalation by local users who can manipulate the file system.

All installations of the jdx: mise tool built before version 2026.7.1 are affected. The issue is present in earlier releases that package the mise executable with ownership of UID 1001 and GID 1001, and the installer extracts it without normalizing to the current user’s identity. The problem most directly applies when the installation path is a shared location such as /usr/local/bin, as the binary is exposed to non‑privileged users who hold the corresponding UID or GID.

The CVSS score of the vulnerability is 6.7, indicating moderate severity. No EPSS score is publicly available and the vulnerability is not listed in CISA’s KEV catalog, suggesting that it is not known to be actively exploited in the wild. Exploitation requires local access to the machine, the ability to write to the installation directory, and possession of the UID or GID 1001. If these conditions are met, an attacker can replace the binary and execute arbitrary code as root. The risk is therefore notable for environments where users with UID or GID 1001 have write access to shared system directories.