{"id":"CVE-2026-92629","kind":"vulnerability","aliases":["CVE-2026-92629"],"related":[],"title":"Lenovo Baiying PC Client: improper authorization lets local user gain elevated privileges","description":"A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.","summary":"Lenovo Baiying PC Client, sold only in the Chinese market, has an improper authorization flaw. A local user with an account can run arbitrary code with elevated privileges.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Lenovo Baiying PC Client (LenovoBaiyingCommercialAddin)","fixed":["1.1.0.295"],"affected":"< 1.1.0.295","ecosystem":"vendor"}],"ecosystems":[],"tags":["baiying","lenovo","local-users","other","privilege-escalation","windows"],"not_affected_if":["addin-1.1.0.295-or-later","no-baiying-installed"],"how_to_check":"Find the installed LenovoBaiyingCommercialAddin component of Lenovo Baiying PC Client; versions below 1.1.0.295 are affected. Launch Baiying to trigger the auto-update, then confirm the version (Lenovo does not document the exact location).","fix":"Update LenovoBaiyingCommercialAddin to 1.1.0.295 or later. It updates automatically when the Baiying application launches; launch Baiying to trigger it.","status":"open","published_at":"2026-10-16T00:17:07+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:27:33+00:00","updated_at":"2026-10-25T03:50:01+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-25T03:27:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Lenovo Baiying PC Client: improper authorization lets local user gain elevated privileges","impact":"high","summary":"Lenovo Baiying PC Client, sold only in the Chinese market, has an improper authorization flaw. A local user with an account can run arbitrary code with elevated privileges.","category":"other","nicknames":[],"who_cares":["lenovo","windows","local-users"],"confidence":0.5,"needs_auth":"yes","worst_case":"local user runs arbitrary code with elevated privileges","analyst_note":"Check the Lenovo security bulletin and the NVD entry for affected Baiying versions and the fixed build; the sources give no version or fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-baiying-installed"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000499,"input_tokens":3292,"output_tokens":340,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Lenovo security bulletin and the NVD entry for affected Baiying versions and the fixed build; the sources give no version or fix.","search":"'-2026':14A,17A '-92629':15A,18A 'account':54B 'allow':82C 'arbitrari':57B,89C 'authent':85C 'author':6A,47B,65C 'baiy':2A,24B,35B,71C 'baiying':20A 'chines':42B,78C 'client':4A,22A,37B,73C 'code':58B,90C 'could':81C 'cve':13A,16A 'distribut':74C 'elev':11A,60B,92C 'escal':32B 'exclus':75C 'execut':88C 'flaw':48B 'gain':10A 'improp':5A,46B,64C 'lenovo':1A,19A,25B,34B,70C 'lenovobaiyingcommercialaddin':23A 'let':7A 'local':8A,27B,50B,84C 'local-us':26B 'market':43B,79C 'pc':3A,21A,36B,72C 'potenti':63C 'privileg':12A,31B,61B,93C 'privilege-escal':30B 'report':68C 'run':56B 'sold':38B 'user':9A,28B,51B,86C 'vulner':66C 'window':33B","nicknames":[],"mitigations":[],"who_affected":"Only Windows PCs running the Lenovo Baiying PC Client (sold only in the Chinese market) with the LenovoBaiyingCommercialAddin component below 1.1.0.295. An attacker needs a local, authenticated account and some user interaction, and can then run code with elevated privileges. Shared or multi-user machines matter most; anyone without Baiying installed can skip this.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:50:01Z","by":"analyst","run_id":801},"products":{"at":"2026-10-25T03:50:01Z","by":"analyst","run_id":801}},"analyst_revisit_at":null,"first_public_at":"2026-10-16T00:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@lenovo.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92629","severity":null,"published_at":"2026-10-16T00:17:07+00:00","modified_at":"2026-10-16T19:55:59+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92629:801","url":null,"severity":null,"published_at":"2026-10-25T03:50:01+00:00","modified_at":"2026-10-25T03:50:01+00:00","first_seen_at":"2026-10-25T03:50:01+00:00","fetched_at":"2026-10-25T03:50:01+00:00","note":"Lenovo advisory LEN-227313 (iknow.lenovo.com.cn/detail/442628): fixed in LenovoBaiyingCommercialAddin 1.1.0.295, auto-updates on app launch; CVE record says affected <1.1.0.295. No exploitation or PoC found; social search not run (obscure China-only product). Vendor does not give a check procedure; how_to_check is inferred."}],"documents":[{"id":3366,"url":"https://iknow.lenovo.com.cn/detail/442628","title":"LEN-227313 Lenovo Baiying PC client vulnerability (Lenovo)","kind":"advisory","source":"analyst","text":"Lenovo advisory LEN-227313, CVE-2026-92629, High, potential impact code execution, 2026-10-14. Improper authorization in Baiying PC client may let a local attacker execute arbitrary code with elevated privileges. Solution: update LenovoBaiyingCommercialAddin to 1.1.0.295 or higher; it updates automatically when the Baiying application launches.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3367,"url":"https://www.cve.org/CVERecord?id=CVE-2026-92629","title":"CVE Record CVE-2026-92629","kind":"other","source":"analyst","text":"CWE-862 Missing Authorization. CVSS 4.0 7.0, CVSS 3.1 7.3 (AV:L/PR:L/UI:R). Lenovo Baiying PC Client affected from 0 before 1.1.0.295.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}