NortheBridge/luminalshine has Incorrect Permission Assignment for Critical Resource and Creation of Temporary File in Directory with Insecure Permissions

Why this deserves its current priority

CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps NortheBridge/luminalshine (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for NortheBridge/luminalshine.
2. 2Review the reported fix. Update NortheBridge/luminalshine to 26.05.0-rc4 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Aug 12, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 9, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 12, 2026

Sources and claim methodology

• GitHub security advisorygithub.com

Related CVEs

• Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServerSame generic ecosystem
• Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflowSame generic ecosystem
• coollabsio Coolify GitHub App Setup redirect missing authenticationSame generic ecosystem
• Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainerSame generic ecosystem
• Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix MatchingSame generic ecosystem
• AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profileSame generic ecosystem