CVE-2026-77827 in Link
Summary
by MITRE • 09/09/2026
Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalation for a standard user account via improper write privileges in 'C:\ProgramData\Maono'. Fixed in 4.0.80.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in Maono Link version 3.8.13 represents a critical security flaw within the Windows service component known as MaonoAiServices, which facilitates local privilege escalation for standard user accounts. This issue stems from improper file system access control configurations applied to the directory located at C:\ProgramData\Maono. In typical software deployment scenarios on Microsoft Windows operating systems, directories under ProgramData are often intended for shared application data that may require write permissions by multiple users or services. However, when these directories lack restrictive Access Control Lists (ACLs), they become susceptible to manipulation by any authenticated user with local access rights.
The technical root cause of this vulnerability is classified as CWE-732: Incorrect Permission Assignment for Critical Resource. The MaonoAiServices service likely operates with elevated privileges or interacts with system-level resources, but the underlying data directory it relies upon does not enforce strict ownership and permission constraints. Consequently, a standard user account can create, modify, or replace files within this directory without authorization from an administrator. This misconfiguration allows attackers to inject malicious payloads into paths that are subsequently executed by the service running under higher privilege levels, effectively bypassing standard security boundaries.
From an operational perspective, this flaw enables Local Privilege Escalation (LPE), a severe threat vector categorized under MITRE ATT&CK technique T1068: Exploitation for Privilege Escalation. An attacker with low-level access to the compromised workstation can exploit this weakness to gain administrative rights or SYSTEM-level privileges. Once elevated, the attacker can install persistent backdoors, dump credential hashes from memory using tools like Mimikatz, modify security policies, and move laterally across the network with minimal resistance. The impact is particularly acute in enterprise environments where workstations are shared among multiple users or connected to sensitive internal networks.
The vulnerability was addressed in Maono Link version 4.0.80 through remediation of the file system permissions associated with the C:\ProgramData\Maono directory. Effective mitigation involves ensuring that critical application directories adhere to the principle of least privilege, restricting write access exclusively to authorized administrators and specific service accounts rather than allowing broad user-level modifications. Organizations relying on this software should immediately update to version 4.0.80 or later. In cases where immediate patching is not feasible, manual remediation can be performed by auditing the ACLs on the affected directory and removing write permissions for standard users while maintaining necessary access for the MaonoAiServices service account. Regular security audits of file system permissions across all installed applications are recommended to prevent similar misconfigurations in future deployments.