{"items":[{"id":"NVI-00016062","kind":"vulnerability","title":"garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-wjhr-76vg-2hvc","CVE-2026-54447"],"plain_summary":"GitHub lists this reviewed advisory for garminconnect. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-132aa9358160f3ea0e12ea94e6c56569"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-15T17:33:01.000Z","value":"8.4 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-132aa9358160f3ea0e12ea94e6c56569"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-132aa9358160f3ea0e12ea94e6c56569","url":"https://github.com/advisories/GHSA-wjhr-76vg-2hvc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-wjhr-76vg-2hvc","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T09:59:43.724Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-132aa9358160f3ea0e12ea94e6c56569"],"technology":"garminconnect","known_exclusions":[],"conditions_summary":"## Insecure Permission Assignment for Garmin OAuth Token Store\n\n### Summary\n\n`garminconnect` (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (`022`) the token file `garmin_tokens.json` was created world-readable (`0o644`). The file contains the DI **refresh token**, so any other local user on a shared host could read it and obtain persistent, unauthorized access to the victim's Garmin Connect account.\n\n- **Severity:** High\n- **Weakness:** CWE-732 (Incorrect Permission Assignment for Critical Resource)\n- **Affected versions:** ` None:\n    p = Path(path).expanduser()\n    if p.is_dir() or not p.name.endswith(\".json\"):\n        p = p / \"garmin_tokens.json\"\n    p.parent.mkdir(parents=True, exist_ok=True)   # no mode=\n    p.write_text(self.dumps())                     # no permission restriction\n```\n\nThe serialized payload includes `di_token`, `di_refresh_token`, and `di_client_id`. The call is in ","public_affected_ranges":["<= 0.3.4"]}],"null_published_at":"2026-11-04T10:04:27.874Z","source_updated_at":"2026-07-15T17:33:01.000Z","source_disclosed_at":"2026-07-15T17:33:00.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T09:59:43.724Z"}],"next_cursor":null,"snapshot_revision":"42594"}