CVE-2026-96283

Summary

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

Affected Software

Weaknesses

• CWE-862: Missing Authorization

Workarounds

No known mitigation other than updating.

References

• https://access.redhat.com/security/cve/CVE-2026-96283
• https://bugzilla.redhat.com/show_bug.cgi?id=2539424
• https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg

• ←Previous
• Next→