CVE-2026-50601
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain administrative access to repository infrastructure and modify software source code. To mitigate this security risk, Acer has released an update to resolve the issue.
Risk Assessment
Unauthorized access to repositories could lead to theft of confidential data, modification of source code, and compromise of software integrity.
Recommendation
It is recommended to immediately install the update released by Acer and rotate all keys and secrets that may have been exposed.
Original NVD description (English source)
A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain administrative access to repository infrastructure and modify software source code. To mitigate this security risk, Acer has released an update to resolve the issue.