CVE-2026-16246CWE-276

Insecure permission assignment due to execution of LogPathConfig.exe during setup

High · published July 20, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
4.3
In the wild
Unconfirmed
What it is

In BRAIN2 versions prior to 3.09, the

application LogPathConfig.exe is executed during setup. As a result, the

Windows group Everyone is granted full control over %ProgramData% instead of

being restricted to %ProgramData%\Bizerba\BRAIN2\.

Starting with BRAIN2 3.09, the setup no

longer executes this tool.

However, the optional component Bizerba ScriptService still executes it.

Bizerba ScriptService is being

deprecated and will no longer be included starting with BRAIN2 version 3.11.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00155 · 4.3th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2026-07-20T11:51Z
EPSS history
Timeline
  • 20 JUL 11:51Z
    Insecure permission assignment due to execution of LogPathConfig.exe during setup
    cvelistv5