{"id":"CVE-2026-59000","kind":"vulnerability","aliases":["CVE-2026-59000"],"related":[],"title":"Unnamed product: permission bypass via confused deputy allows local privilege escalation","description":"In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"Multiple locations in an unnamed product contain a confused deputy flaw that lets a process bypass permission checks. An attacker with local access could escalate privileges without additional execution rights or user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","unknown-product"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:55+00:00","first_seen_at":"2026-11-02T20:35:35+00:00","triaged_at":"2026-11-02T20:37:06+00:00","updated_at":"2026-11-02T20:37:06+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-02T20:37:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Unnamed product: permission bypass via confused deputy allows local privilege escalation","impact":"high","summary":"Multiple locations in an unnamed product contain a confused deputy flaw that lets a process bypass permission checks. An attacker with local access could escalate privileges without additional execution rights or user interaction.","audience":"businesses","category":"other","nicknames":[],"who_cares":["unknown-product"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local user gains elevated privileges on the machine","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-59000 and find the vendor advisory for the fix.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources do not name the affected product or versions, so teams cannot yet tell whether they run it. Only systems where an untrusted local user or process can run code are relevant to the described local escalation.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00062,"input_tokens":4070,"output_tokens":425,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59000':14A,17A 'access':44B 'addit':49B,79C 'allow':8A 'attack':41B 'bypass':4A,37B,63C 'check':39B 'confus':6A,30B,67C 'contain':28B 'could':45B,70C 'cve':12A,15A 'deputi':7A,31B,68C 'due':64C 'escal':11A,46B,74C 'execut':50B,80C 'exploit':89C 'flaw':32B 'interact':54B,84C 'lead':71C 'let':34B 'local':9A,43B,73C 'locat':23B,57C 'multipl':22B,56C 'need':82C,87C 'permiss':3A,38B,62C 'possibl':61C 'privileg':10A,47B,76C,81C 'process':36B 'product':2A,21B,27B 'right':51B 'unknown':20B 'unknown-product':19B 'unnam':1A,26B 'user':53B,83C 'via':5A 'without':48B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["other","unknown","unknownproduct"],"first_public_at":"2026-11-02T20:17:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59000","severity":null,"published_at":"2026-11-02T20:17:55+00:00","modified_at":"2026-11-02T20:17:55+00:00","first_seen_at":"2026-11-02T20:35:35+00:00","fetched_at":"2026-11-02T20:35:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}