CVE-2026-54447

garminconnect, a Python 3 API wrapper for Garmin Connect, incorrectly assigns permissions when Client.dump (and the Garmin.login tokenstore path) creates its OAuth token directory and the garmin_tokens. file, so a permissive umask such as 022 leaves the directory at 0755 and the token file at 0644. Any other unprivileged user on the same shared Linux or macOS host can then read the stored di_refresh_token from the world-readable file. With that token, the attacker gains persistent access to the victim's Garmin Connect account, including health, fitness, activity, and device data (CVSS 3.1: 8.4, high; scope changed, high confidentiality and integrity impact). Users of garminconnect versions prior to 0.3.5 on multi-user systems are affected, and note that a pre-existing loosely permissioned token file remains exposed even after upgrading until it is rewritten or manually restricted. The issue is fixed in version 0.3.5; there is no known public PoC and no indication of exploitation in the wild (not in CISA KEV).

What to do: Upgrade to garminconnect 0.3.5 or later, which creates the token directory and garmin_tokens. with owner-only modes. Because previously written token files stay loosely permissioned until rewritten, manually run chmod 700 on the token directory and chmod 600 on garmin_tokens. (verify with ls -l), and consider invalidating the exposed refresh token by logging out and back in or changing the Garmin account password. Risk is greatest on shared multi-user Linux/macOS hosts; single-user systems are largely unaffected.