RansomLook creates its Flask session‑signing key without restricting file permissions. The secret_key file is written with the process’s default umask, often resulting in 0644. Because the file resides in the application’s home directory, any local user with read access can obtain the key. The key is used to sign session cookies and to derive legacy API‑keys, so an attacker who reads it can forge valid session cookies, impersonate any authenticated user, and even take on administrator privileges. The vulnerability is a classic example of insecure file permissions (CWE‑276 and CWE‑732) that jeopardize authentication and authorization across the application.

All publicly available releases of the RansomLook application are affected; version or build information is not specified in the advisory.

The issue is local only and requires read access to the insecure secret_key file. An attacker with such access can immediately compromise the application’s authentication and authorization controls. The CVSS base score of 7 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation in the wild.