Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2026-76159

Duplicati for Windows - Incorrect Permission Assignment for Critical Resource

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ZUSO ART

Description

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Duplicati Duplicati

Default version status: unaffected

  • 0 to < v2.4.0.0affected

References