An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as file_mode= by manipulating (for example) the domain parameter of the samba URL.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-12561.json"