Incorrect Permission Assignment for Critical Resource Affecting garminconnect package, versions [,0.3.5)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-GARMINCONNECT-18017906
- published19 Jul 2026
- disclosed15 Jul 2026
- creditUnknown
Introduced: 15 Jul 2026
NewCVE-2026-54447 (opens in a new tab)How to fix?
Upgrade garminconnect to version 0.3.5 or higher.
Overview
garminconnect is a Python 3 API wrapper for Garmin Connect
Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to insecure file-system permissions being set on the OAuth token store by the dump function. An attacker can gain unauthorized access to sensitive authentication tokens by reading the world-readable token file as a local, unprivileged user on the same host.
Workaround
This vulnerability can be mitigated by manually restricting permissions on the token directory and file using 'chmod 700 ~/.garminconnect' and 'chmod 600 ~/.garminconnect/garmin_tokens.json'.