High · published November 14, 2025
⚡ A local attacker can manipulate default permissions in Sonarr, potentially leading to unauthorized actions! 👀 Think of this as a service employee who has a set of keys but can’t access the vault unless they switch jobs to a higher position. However, if they can somehow convince the system they belong to a higher rank, they could access sensitive files. An attacker with local access could gain unauthorized permissions, allowing them to read, modify, or delete data managed by Sonarr. While this requires a significant leap — either changing service accounts or having admin access — the implications of successful manipulation could be serious for users' data security.
Think of this as a service employee who has a set of keys but can’t access the vault unless they switch jobs to a higher position. However, if they can somehow convince the system they belong to a higher rank, they could access sensitive files. The vulnerability revolves around incorrect default permissions in the file C:\ProgramData\Sonarr\bin\Sonarr.Console.exe when manipulated. This occurs due to the service handling permissions improperly, allowing potential privilege escalation by local users.
An attacker with local access could gain unauthorized permissions, allowing them to read, modify, or delete data managed by Sonarr. While this requires a significant leap — either changing service accounts or having admin access — the implications of successful manipulation could be serious for users' data security. To mitigate this risk, ensure that Sonarr runs under a least-privilege account, avoid using highly privileged accounts for service operations, and monitor local user activities. Plan to upgrade to Sonarr v5, where this issue is expected to be resolved! You've got this! By following these steps, you'll keep your data safe and sound. 🛡️