{"id":"CVE-2026-119981","kind":"vulnerability","aliases":["CVE-2026-119981"],"related":[],"title":"Visual Studio Code: missing authentication lets a local user gain higher privileges","description":"Missing authentication for critical function in Visual Studio Code allows an authorized attacker to elevate privileges locally.","summary":"Visual Studio Code has a critical function that does not check authentication, so an attacker who already has an account on the machine can raise their privileges. The attack runs locally and needs no internet access.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","macos","other","visual-studio-code","windows"],"not_affected_if":["single-user-machine"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:23+00:00","first_seen_at":"2026-11-10T19:25:06+00:00","triaged_at":"2026-11-10T19:51:25+00:00","updated_at":"2026-11-10T19:51:25+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T19:51:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Visual Studio Code: missing authentication lets a local user gain higher privileges","impact":"high","summary":"Visual Studio Code has a critical function that does not check authentication, so an attacker who already has an account on the machine can raise their privileges. The attack runs locally and needs no internet access.","audience":"developers","category":"other","nicknames":[],"who_cares":["visual-studio-code","windows","macos","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the machine","analyst_note":"Check the NVD entry and Microsoft's advisory for affected Visual Studio Code versions and the fixed release.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-machine"],"who_is_affected":"Developers running Visual Studio Code on a shared or multi-user machine could be exposed, since the attacker must already be an authorized local user. The sources do not say which Visual Studio Code versions or configurations are affected. Single-user machines where only the developer has an account are unlikely to be at meaningful risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":4486,"output_tokens":446,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the NVD entry and Microsoft's advisory for affected Visual Studio Code versions and the fixed release.","search":"'-119981':15A,18A '-2026':14A,17A 'access':62B 'account':46B 'allow':72C 'alreadi':43B 'attack':41B,55B,75C 'authent':5A,38B,64C 'author':74C 'check':37B 'code':3A,25B,29B,71C 'critic':32B,66C 'cve':13A,16A 'elev':77C 'function':33B,67C 'gain':10A 'higher':11A 'internet':61B 'let':6A 'linux':19B 'local':8A,57B,79C 'machin':49B 'maco':20B 'miss':4A,63C 'need':59B 'privileg':12A,53B,78C 'rais':51B 'run':56B 'studio':2A,24B,28B,70C 'user':9A 'visual':1A,23B,27B,69C 'visual-studio-cod':22B 'window':26B","nicknames":[],"mitigations":[],"who_affected":"Developers running Visual Studio Code on a shared or multi-user machine could be exposed, since the attacker must already be an authorized local user. The sources do not say which Visual Studio Code versions or configurations are affected. Single-user machines where only the developer has an account are unlikely to be at meaningful risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","linux","macos","other","visualstudiocode","windows"],"campaign_type":null,"search_a":"'-119981':15A,18A '-2026':14A,17A 'authent':5A 'code':3A 'cve':13A,16A 'gain':10A 'higher':11A 'let':6A 'local':8A 'miss':4A 'privileg':12A 'studio':2A 'user':9A 'visual':1A","search_b":"'access':62B 'account':46B 'alreadi':43B 'attack':41B,55B 'authent':38B 'check':37B 'code':25B,29B 'critic':32B 'function':33B 'internet':61B 'linux':19B 'local':57B 'machin':49B 'maco':20B 'need':59B 'privileg':53B 'rais':51B 'run':56B 'studio':24B,28B 'visual':23B,27B 'visual-studio-cod':22B 'window':26B","search_c":"'allow':72C 'attack':75C 'authent':64C 'author':74C 'code':71C 'critic':66C 'elev':77C 'function':67C 'local':79C 'miss':63C 'privileg':78C 'studio':70C 'visual':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119981","severity":null,"published_at":"2026-11-10T19:20:23+00:00","modified_at":"2026-11-10T19:20:23+00:00","first_seen_at":"2026-11-10T19:25:06+00:00","fetched_at":"2026-11-10T19:25:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}