CyberRota Analysis
AI-GeneratedA vulnerability exists in NortheBridge/luminalshine prior to version 26.05.0-rc4, affecting Windows installations where the `apps.json` file at `C:\ProgramData\LuminalShine\config\` may be improperly configured. Although the default permissions limit write access for standard users, the potential for elevation of privilege (EoP) exists if the file's access control lists (ACLs) are altered. Organizations using this game stream host should prioritize upgrading to the patched version or ensure default DACLs are maintained to mitigate risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at `src/platform/windows/misc.cpp` lives at `C:\ProgramData\LuminalShine\config\apps.json` and is created by the `SYSTEM` service. Under Windows' default `C:\ProgramData` inheritance, that gives `BUILTIN\Users` only Read+Execute — not writable — so the canonical EoP doesn't actually trigger on a vanilla install. Version 26.05.0-rc4 contains a patch for the issue. As a workaround, use default condition DACLs for `ProgramData`.