Not every entry in this database is a critical data-loss story. This one is a Moderate-severity, already-patched CVE — worth documenting precisely because the corpus should reflect the full range, not just the worst incidents.
What happened
Security researcher edbr reported via HackerOne that Claude Code on Windows loaded its system-wide managed-settings.json from C:\ProgramData\ClaudeCode without checking who owned or could write to that directory. ProgramData is writable by standard (non-administrative) users by default on Windows, and if the ClaudeCode subdirectory didn't already exist or wasn't access-restricted, any low-privileged local account on a shared machine could create it first and drop a config of its own choosing there.
That config can define a session-start hook. So a standard user who got there first could plant a hook that would silently execute — under whatever privileges the next user who launched Claude Code on that machine happened to have.
Why this pattern matters
This is CWE-426, "Untrusted Search Path" — a well-known vulnerability class: software that looks for config or executables in a location it doesn't verify is protected. It's a classic local-privesc primitive, not novel to AI tooling, but it shows up here because Claude Code needed a place to read machine-wide managed settings from, and picked a path that's writable by the very users those settings are supposed to constrain.
Severity, and what the source establishes
Anthropic assigned CVE-2026-35603, rated CVSS v4.0 5.4 (Moderate) — the first medium-severity entry in this database's 90+ incidents, most of which are critical or high. That's not an accident of scoring: exploitation requires a shared multi-user Windows machine, an attacker with local standard-user access, and a victim who launches Claude Code afterward — a narrower real-world path than the critical remote-code-execution incidents already documented here. No in-the-wild exploitation was reported.
Anthropic fixed it in version 2.1.75 by relocating managed settings to a write-protected path under Program Files, and pre-notified enterprise customers since the move changes where admins must place their managed config.
What it doesn't establish
There's no evidence this was ever exploited, and the vendor advisory (the primary source) doesn't speak to how long the vulnerable path existed before the HackerOne report or how many ProgramData-based configs might have been silently overwritten in the wild before the fix. If you administer Claude Code on shared Windows machines, the actionable step is simply: update to 2.1.75+, which the relocation makes structurally impossible to reintroduce via the old path.
Status
Fixed in 2.1.75. No known exploitation.
Full incident record and severity scoring: STUPID-2026-0090
This is one of 90+ verified, severity-scored AI agent incidents documented at StupidLLM, an open incident database for AI coding agent failures.
Top comments (0)