CVE-2026-87876

Published: Sep 9, 2026Modified: Oct 21, 2026

3.0

Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Exploitability: 1.5 / Impact: 1.4

Source: secalert@redhat.com (Secondary)

Description

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Related CWEs

Improper Handling of Case Sensitivity

The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

References (7)

https://access.redhat.com/errata/RHSA-2026:67568

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-87876

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2530991

Source: secalert@redhat.com

https://github.com/OpenPrinting/cups/commit/88e67c00c130a45f3a1edf36686f7a0b2982fef8

Source: secalert@redhat.com

https://github.com/OpenPrinting/cups/commit/f56844dbe4a54a9f8e1aeb3b913fbee614156bdb

Source: secalert@redhat.com

https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2

Source: secalert@redhat.com

https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.