Qt looks in C:\ProgramData\... for MIME and logging configuration files on Windows. This path is intended to be writable by all users on the system ("/tmp"-like), so any user could create these files.
It does not appear this is currently dangerous; there is a DoS threat, but a local user could just as well shut down the machine to achieve the same thing.
However, it would be best to avoid letting other users reconfigure anything if possible. Unfortunately, I don't see any way to tell Qt not to do this.
Since we have chosen to ignore worse multiuser compromises (eg, CVE-2018-20587), it seems likely this issue can just be ignored until some future time where fixing it is more practical. However, any Qt depends bumps should probably be audited to ensure this vulnerability does not create a dangerous situation due to new usage of C:\ProgramData (eg, we wouldn't want to load random DLLs found there).
Initially reported by Xavier Danest and analysed also by @laanwj and @sipsorcery
