CVE-2026-108582 in GenOffice
Summary
by MITRE • 10/10/2026
GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to read client uploads and converted outputs, bypassing the HTTP bearer token.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in GenOffice versions through 0.11.505 represents a critical failure in access control mechanisms within its HTTP MCP server file store component. This flaw stems from an incorrect permissions configuration that results in world-readable directories being created for storing uploaded and generated documents. Specifically, the system utilizes a directory named genoffice-mcp-http located under the system temporary directory, which is inadvertently assigned permissions that allow any user on the local operating system to read its contents without authentication. This misconfiguration effectively bypasses the intended security controls provided by HTTP bearer tokens, as an attacker does not need valid credentials to access sensitive data stored within this location.
From a technical perspective, the root cause of this issue lies in how temporary files and directories are handled during document processing operations. When users upload documents or when GenOffice generates output from those uploads, these files are temporarily placed in the aforementioned directory before being processed or served. The operating system's default behavior for creating temporary resources often results in permissions that may be too permissive if not explicitly restricted by the application code. In this case, the application fails to enforce restrictive file access controls on the genoffice-mcp-http directory, leaving it accessible to all local users regardless of their privilege level or authentication status. This allows unprivileged accounts to traverse and read files intended for specific authenticated sessions.
The operational impact of this vulnerability is significant, particularly in multi-user environments where multiple individuals share a single host system. Local attackers with even minimal access can enumerate the contents of the temporary directory using standard file listing commands. By doing so, they can identify filenames that may correspond to sensitive business documents, personal information, or proprietary data uploaded by other users. Since these files are readable without authentication, an attacker can download and inspect them at will. This constitutes a severe breach of confidentiality, potentially leading to the exposure of intellectual property, customer data, or internal communications depending on what types of documents were processed through the GenOffice platform during that time window.
This vulnerability aligns with CWE-732: Incorrect Permission Assignment for Critical Resource, as it involves assigning overly permissive access rights to a resource containing sensitive information. Furthermore, from an offensive security standpoint such as the MITRE ATT&CK framework, this flaw facilitates Local Privilege Escalation and Credential Access indirectly by allowing unauthorized data exfiltration without needing to compromise user credentials directly. It also relates to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor because it results in the unintended disclosure of private documents to any local process or user on the system.
To mitigate this vulnerability, immediate action should be taken by upgrading GenOffice to a version later than 0.11.505 where these permission issues have been addressed. In environments where upgrading is not immediately feasible, administrators can implement manual workarounds such as restricting access to the temporary directory using operating system-level file permissions or ACLs (Access Control Lists) to ensure that only the specific service account running GenOffice has read and write access. Additionally, configuring the application to use a dedicated, isolated temporary storage location with strict permission settings rather than relying on default system temp directories can reduce the risk of cross-user data leakage. Regular audits of file permissions for any directory used by web-facing or network-service applications are recommended to prevent similar misconfigurations in the future.