Claude Code loaded managed config from a world-writable Windows path, enabling local privilege escalation (CVE-2026-35603)

1. Instruction given

   N/A — this is a flaw in Claude Code's own startup configuration loading on Windows, not a task given to the agent by a user.

2. Expected behavior

   System-wide managed settings should load only from an admin-controlled, write-protected location, so an unprivileged local user cannot influence what configuration or hooks execute in another user's session.

3. Actual behavior

   Claude Code loaded managed-settings.json from C:\ProgramData\ClaudeCode without checking directory ownership or permissions. Because ProgramData is writable by non-administrative users by default and the ClaudeCode subdirectory did not exist or was not access-restricted, any low-privileged local user could create it and drop a malicious config containing a session-start hook.

4. Damage

   On a shared multi-user Windows machine, a standard user could plant a config that auto-ran an attacker-controlled hook under any other user's context the next time that user launched Claude Code — full local privilege escalation (CWE-426: Untrusted Search Path), rated CVSS v4.0 5.4 (Moderate). No in-the-wild exploitation was reported. Fixed in Claude Code 2.1.75, which relocated managed settings to a write-protected Program Files path; Anthropic pre-notified enterprise customers since the move changed where admins must place managed config.

Classification

Agent

Claude Code

Failure mode

Security Vulnerability

Root cause

Other

Domain

Security

Source

Security Research