Every CVE Search/ Get API key

CVE-2026-7867

Udisks2: udisks2: local privilege escalation via as-user option spoofing

7.8 HighPublic exploitFix available

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.17%Unchanged since Aug 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.8

Udisks2: udisks2: local privilege escalation via as-user option spoofing

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

Record
CVE-2026-7867
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2026-54277 7.8

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

Record
EUVD-2026-54277
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 7.8

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

Record
CVE-2026-7867
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-05
OSV 7.8

Udisks2: udisks2: local privilege escalation via as-user option spoofing

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

Record
CVE-2026-7867
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-05
OSVDEBIAN-CVE-2026-7867 7.8

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

Record
DEBIAN-CVE-2026-7867
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVOESA-2026-3460 7.8

udisks2 security update

The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies.

Security Fix(es):

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.(CVE-2026-7867)

Record
OESA-2026-3460
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 13 moreShow less
OSVOESA-2026-3461 7.8

udisks2 security update

The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies.

Security Fix(es):

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.(CVE-2026-7867)

Record
OESA-2026-3461
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-3462 7.8

udisks2 security update

The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies.

Security Fix(es):

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.(CVE-2026-7867)

Record
OESA-2026-3462
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:53435 7.8

Red Hat Security Advisory: udisks2 security update

Record
RHSA-2026:53435
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:64798 7.8

Red Hat Security Advisory: udisks2 security update

Record
RHSA-2026:64798
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:53435 7.8

Important: udisks2 security update

The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.

Security Fix(es):

  • udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:53435
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-7867 7.8

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

Record
UBUNTU-CVE-2026-7867
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:53435 No score

Important: udisks2 security update

The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.

Security Fix(es):

  • udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:53435
Updated
2026-11-02
OSVMGASA-2026-0453 No score

Updated udisks2 package fixes a security vulnerability

Local privilege escalation via as-user option spoofing. (CVE-2026-7867)

Record
MGASA-2026-0453
Updated
2026-11-02
OSVopenSUSE-SU-2026:11501-1 No score

libudisks2-0-2.11.2-1.1 on GA media

These are all security issues fixed in the libudisks2-0-2.11.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11501-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21704-1 No score

Security update for udisks2

This update for udisks2 fixes the following issue:

  • CVE-2026-7867: insufficient authorization checks on the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method can lead to local privilege escalation (bsc#1274430).
Record
openSUSE-SU-2026:21704-1
Updated
2026-11-02
OSVSUSE-SU-2026:23405-1 No score

Security update for udisks2

This update for udisks2 fixes the following issue:

  • CVE-2026-7867: insufficient authorization checks on the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method can lead to local privilege escalation (bsc#1274430).
Record
SUSE-SU-2026:23405-1
Updated
2026-11-02
OSVSUSE-SU-2026:23575-1 No score

Security update for udisks2

This update for udisks2 fixes the following issue:

  • CVE-2026-7867: insufficient authorization checks on the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method can lead to local privilege escalation (bsc#1274430).
Record
SUSE-SU-2026:23575-1
Updated
2026-11-02
OSVUSN-8701-1 No score

udisks2 vulnerability

It was discovered that UDisks did not correctly validate the caller identity when handling the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. A local attacker with an active console session could possibly use this issue to mount filesystems on behalf of arbitrary users, including privileged accounts, leading to local privilege escalation.

Record
USN-8701-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libudisks2
AlmaLinux:10
 before 2.11.0-2.el10_2.1.alma.2
2.11.0-2.el10_2.1.alma.2
libudisks2-devel
AlmaLinux:10
 before 2.11.0-2.el10_2.1.alma.2
2.11.0-2.el10_2.1.alma.2
udisks2
AlmaLinux:10
 before 2.11.0-2.el10_2.1.alma.2
2.11.0-2.el10_2.1.alma.2
udisks2-iscsi
AlmaLinux:10
 before 2.11.0-2.el10_2.1.alma.2
2.11.0-2.el10_2.1.alma.2
udisks2-lsm
AlmaLinux:10
 before 2.11.0-2.el10_2.1.alma.2
2.11.0-2.el10_2.1.alma.2
udisks2-lvm2
AlmaLinux:10
 before 2.11.0-2.el10_2.1.alma.2
2.11.0-2.el10_2.1.alma.2
udisks2
Debian:13
 before 2.10.1-12.1+deb13u2, plus listed versions
2.10.1-12.12.10.1-12.1+deb13u1
2.10.1-12.1+deb13u2
udisks2
Debian:14
 before 2.11.2-1, plus listed versions
2.10.1-12.12.10.90-12.10.90-22.10.90-32.10.90-3.1
Show 5 moreShow less
2.10.91-12.11.0-12.11.0-22.11.1-12.11.1-2
2.11.2-1
udisks2
Mageia:10
 before 2.10.1-3.1.mga10
2.10.1-3.1.mga10
udisks2
openEuler:24.03-LTS-SP1
 before 2.10.1-10.oe2403sp1
2.10.1-10.oe2403sp1
Show 34 moreShow less
Affected packages
PackageAffectedFixed
udisks2
openEuler:24.03-LTS-SP3
 before 2.10.1-10.oe2403sp3
2.10.1-10.oe2403sp3
udisks2
openEuler:24.03-LTS-SP4
 before 2.10.1-10.oe2403sp4
2.10.1-10.oe2403sp4
libudisks2
Red Hat:enterprise_linux:10.2
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
libudisks2-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
udisks2
Red Hat:enterprise_linux:10.2
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
udisks2-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
udisks2-debugsource
Red Hat:enterprise_linux:10.2
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
udisks2-iscsi
Red Hat:enterprise_linux:10.2
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
udisks2-iscsi-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
udisks2-lsm
Red Hat:enterprise_linux:10.2
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
udisks2-lsm-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
udisks2-lvm2
Red Hat:enterprise_linux:10.2
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
udisks2-lvm2-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
libudisks2-devel
Red Hat:enterprise_linux:10.2
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
libudisks2
Red Hat:enterprise_linux_eus:10.0
 before 0:2.10.90-5.el10_0.3
0:2.10.90-5.el10_0.3
libudisks2-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:2.10.90-5.el10_0.3
0:2.10.90-5.el10_0.3
udisks2
Red Hat:enterprise_linux_eus:10.0
 before 0:2.10.90-5.el10_0.3
0:2.10.90-5.el10_0.3
udisks2-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:2.10.90-5.el10_0.3
0:2.10.90-5.el10_0.3
udisks2-debugsource
Red Hat:enterprise_linux_eus:10.0
 before 0:2.10.90-5.el10_0.3
0:2.10.90-5.el10_0.3
udisks2-iscsi
Red Hat:enterprise_linux_eus:10.0
 before 0:2.10.90-5.el10_0.3
0:2.10.90-5.el10_0.3
udisks2-iscsi-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:2.10.90-5.el10_0.3
0:2.10.90-5.el10_0.3
udisks2-lsm
Red Hat:enterprise_linux_eus:10.0
 before 0:2.10.90-5.el10_0.3
0:2.10.90-5.el10_0.3
udisks2-lsm-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:2.10.90-5.el10_0.3
0:2.10.90-5.el10_0.3
udisks2-lvm2
Red Hat:enterprise_linux_eus:10.0
 before 0:2.10.90-5.el10_0.3
0:2.10.90-5.el10_0.3
udisks2-lvm2-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:2.10.90-5.el10_0.3
0:2.10.90-5.el10_0.3
libudisks2-devel
Red Hat:enterprise_linux_eus:10.0
 before 0:2.10.90-5.el10_0.3
0:2.10.90-5.el10_0.3
udisks2
Rocky Linux:10
 before 0:2.11.0-2.el10_2.1
0:2.11.0-2.el10_2.1
udisks2
SUSE:Linux Micro 6.2
 before 2.10.1-160000.4.1
2.10.1-160000.4.1
udisks2
SUSE:Linux Enterprise Server 16.0
 before 2.10.1-160000.4.1
2.10.1-160000.4.1
udisks2
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.10.1-160000.4.1
2.10.1-160000.4.1
udisks2
Ubuntu:24.04:LTS
 before 2.10.1-6ubuntu1.5, plus listed versions
2.10.1-1ubuntu12.10.1-1ubuntu22.10.1-62.10.1-6build12.10.1-6ubuntu12.10.1-6ubuntu1.22.10.1-6ubuntu1.3
2.10.1-6ubuntu1.5
udisks2
Ubuntu:26.04:LTS
 before 2.10.91-1ubuntu2.1, plus listed versions
2.10.1-12.1ubuntu22.10.91-1ubuntu12.10.91-1ubuntu2
2.10.91-1ubuntu2.1
udisks2
openSUSE:Tumbleweed
 before 2.11.2-1.1
2.11.2-1.1
udisks2
openSUSE:Leap 16.0
 before 2.10.1-160000.4.1
2.10.1-160000.4.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubazqzazq1/CVE-2026-7867-disk2root2026-05-08

History

History
RecordedChangedSources
factsNVD
first indexedCVE List, EUVD, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-7867 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published August 6, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in libudisks2 2.11.0-2.el10_2.1.alma.2.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open