CVE-2026-96281

Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes

State: Published
Severity: 6.2 Medium
Published: Sep 27, 2026
Updated: Sep 30, 2026
Reserved: Sep 22, 2026

Description

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities.

Scores

CVSS	Score	Vector	Source
3.1	6.2 Medium	CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 9Red Hat

References

https://access.redhat.com/security/cve/CVE-2026-96281vdb-entry
RHBZ#2539421issue-tracking
https://github.com/flatpak/flatpak/security/advisories/GHSA-q4gr-vc25-57m5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.