CVE-2026-76159 in Duplicati
Summary
by MITRE • 09/15/2026
Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified as Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows prior to version 2.4.0.0 represents a significant security flaw rooted in improper access control mechanisms during the application's initialization phase. This issue specifically affects the handling of the preload.json file, which is utilized by the software to load initial settings or extensions before full execution. The core technical deficiency lies in the fact that this configuration file is created with permissions that allow modification by users who possess only low-level privileges on the Windows operating system. In a typical Windows environment, standard user accounts do not have administrative rights and are restricted from modifying critical system files or registry keys associated with high-privilege processes. However, because Duplicati writes its preload configuration file to a location accessible to these lower-privileged users without restricting write access appropriately, it creates an exploitable condition where the integrity of the application's startup sequence can be compromised by any local user on the machine.
From a technical perspective, this vulnerability facilitates Local Privilege Escalation (LPE), allowing an attacker with basic user-level access to elevate their privileges to NT AUTHORITY\SYSTEM, which is the highest level of privilege in Windows environments. The attack vector involves the creation or modification of the preload.json file by the low-privileged attacker prior to launching Duplicati. By injecting malicious code or configuration directives into this JSON file, such as commands for arbitrary executable execution or manipulation of internal application states, the attacker ensures that when Duplicati starts up with elevated privileges, it processes these instructions under the context of the SYSTEM account. This effectively bypasses standard security boundaries because the operating system trusts the integrity of files written by higher-privilege processes during their setup phase, assuming they are not tampered with by lower-privileged entities. The flaw exploits the principle of insecure default permissions where write access is granted too broadly to non-administrative users for resources that influence privileged execution paths.
The operational impact of this vulnerability is severe due to the complete compromise of system integrity and confidentiality once SYSTEM-level privileges are achieved. An attacker gaining NT AUTHORITY\SYSTEM rights can install rootkits, modify security policies, create new administrative accounts, access sensitive data stored in protected directories, or disable security software such as antivirus solutions and firewalls. This level of control allows for persistent backdooring of the host system and potentially lateral movement within a network if other systems are accessible from this compromised machine. The risk is particularly acute in multi-user environments where multiple individuals share a single workstation or server, as any user can exploit this flaw to gain full control over the entire operating system without needing valid credentials for an administrative account. This undermines the fundamental security model of least privilege and trust boundaries within Windows-based infrastructures.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-276, which describes Incorrect Default Permissions, where a developer fails to set appropriate access controls on a resource that is critical for system stability or security. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1055, specifically sub-technique T1055.012 regarding Process Injection and Privilege Escalation via Windows Security Mechanisms Abuse. The attack relies on manipulating a configuration file that is read by a privileged process, which is also consistent with CWE-94 Improper Control of Generation of Code or Command (Code Injection) if the JSON content leads to arbitrary code execution within the elevated context. Understanding these mappings helps in categorizing the risk and aligning remediation efforts with established industry frameworks for vulnerability management.
Mitigation strategies must focus on both immediate patching and long-term hardening practices. The primary and most effective solution is to upgrade Duplicati to version 2.4.0.0 or later, where this permission issue has been resolved by the developers through stricter file access controls during the creation of the preload.json configuration file. Until an update can be applied, administrators should consider restricting write permissions on the specific directory containing the configuration files to only administrative accounts, although this may interfere with normal application functionality if not carefully managed. Additionally, implementing strict Application Control policies such as Windows Defender Application Control (WDAC) or AppLocker can prevent unauthorized modifications to executable paths and critical configuration directories. Regular auditing of file system permissions for applications running under high-privilege contexts is also recommended to detect similar misconfigurations early. Security teams should monitor for unusual process creation events involving Duplicati that originate from non-standard user accounts, as this may indicate an attempted exploitation of this vulnerability in environments where patching has not yet been completed.