GHSA-R3R2-35V9-V238

Vulnerability from github – Published: 2026-03-23 21:40 – Updated: 2026-03-27 20:57
VLAI
Summary
Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions
Details

Impact

If a developer uses Briefcase to produce an Windows MSI installer for a project, and that project is installed for All Users (i.e., per-machine scope), the installation process creates an directory that inherits all the permissions of the parent directory. Depending on the location chosen by the installing user, this may allow a low privilege but authenticated user to replace or modify the binaries installed by the application. If an administrator then runs the altered binary, the binary will run with elevated privileges.

Patches

The problem is caused by the template used to generate the WXS file for Windows projects. It was fixed with the following PRs:

  • beeware/briefcase-windows-app-template#86
  • beeware/briefcase-windows-VisualStudio-template#85

These patches have been backported to the templates used in Briefcase 0.3.26, 0.4.0, and 0.4.1. Re-running briefcase create on your Briefcase project will result in the updated templates being used.

Workarounds

The change from beeware/briefcase-windows-app-template#86 can be added to any existing Briefcase .wxs file generated by Briefcase 0.3.24 or later.

Resources

beeware/briefcase#2759 is a formal bug report of the problem.

Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "briefcase"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.0"
            },
            {
              "fixed": "0.3.26"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33430"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-23T21:40:10Z",
    "nvd_published_at": "2026-03-26T17:16:38Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nIf a developer uses Briefcase to produce an Windows MSI installer for a project, and that project is installed for All Users (i.e., per-machine scope), the installation process creates an directory that inherits all the permissions of the parent directory. Depending on the location chosen by the installing user, this may allow a low privilege but authenticated user to replace or modify the binaries installed by the application. If an administrator then runs the altered binary, the binary will run with elevated privileges.\n\n### Patches\n\nThe problem is caused by the template used to generate the WXS file for Windows projects. It was fixed with the following PRs:\n\n* beeware/briefcase-windows-app-template#86\n* beeware/briefcase-windows-VisualStudio-template#85\n\nThese patches have been backported to the templates used in Briefcase 0.3.26, 0.4.0, and 0.4.1. Re-running `briefcase create` on your Briefcase project will result in the updated templates being used.\n\n### Workarounds\n\nThe change from beeware/briefcase-windows-app-template#86 can be added to any existing Briefcase .wxs file generated by Briefcase 0.3.24 or later.\n\n### Resources\n\nbeeware/briefcase#2759 is a formal bug report of the problem.",
  "id": "GHSA-r3r2-35v9-v238",
  "modified": "2026-03-27T20:57:16Z",
  "published": "2026-03-23T21:40:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/beeware/briefcase/security/advisories/GHSA-r3r2-35v9-v238"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/beeware/briefcase/issues/2759"
    },
    {
      "type": "WEB",
      "url": "https://github.com/beeware/briefcase-windows-VisualStudio-template/pull/85"
    },
    {
      "type": "WEB",
      "url": "https://github.com/beeware/briefcase-windows-app-template/pull/86"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/beeware/briefcase"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions "
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.