CVE-2026-96283

Published: Sep 27, 2026Modified: Sep 29, 2026

3.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Exploitability: 1.8 / Impact: 1.4

Source: secalert@redhat.com (Secondary)

Description

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://access.redhat.com/security/cve/CVE-2026-96283

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2539424

Source: secalert@redhat.com

https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg

Source: secalert@redhat.com

Timeline

No history available yet.