Every CVE Search/ Get API key

CVE-2026-96281

Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes

6.2 MediumFix available

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.12%Unchanged since Sep 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.2

Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities.

Record
CVE-2026-96281
CVSS 3.1
6.2 MediumCVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-06
EUVDEUVD-2026-88027 6.2

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities.

Record
EUVD-2026-88027
CVSS 3.1
6.2 MediumCVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-06
NVD 6.2

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities.

Record
CVE-2026-96281
CVSS 3.1
6.2 MediumCVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-06
OSVDEBIAN-CVE-2026-96281 6.2

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities.

Record
DEBIAN-CVE-2026-96281
CVSS 3.1
6.2 MediumCVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-96281 6.2

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities.

Record
UBUNTU-CVE-2026-96281
CVSS 3.1
6.2 MediumCVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVSUSE-SU-2026:4610-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96283: flatpak-system-helper: cross-user CancelPull orphans another user's ongoing pull (bsc#1282521).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).
Record
SUSE-SU-2026:4610-1
Updated
2026-11-02
OSVSUSE-SU-2026:4944-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

  • Update to version 1.16.6 (jsc#PED-17048):
  • Fix file descriptor leaks affecting Chromium-based browsers.
  • Fix installing extra-data without a runtime, including openh264.
  • Fix unusable sandbox-expose paths affecting Epiphany.
  • Fix installed tests and handling of file descriptor arguments.
  • Changes from version 1.16.5:
  • Fix regressions from the sandbox escape security fix affecting browsers, browser-based apps and Steam.
  • Expand test coverage of flatpak-run features used by the portal.
  • Changes from version 1.16.4:
  • Prevent arbitrary file reads in the system-helper context (GHSA-2fxp-43j9-pwvc).
  • Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg).
  • Changes from version 1.16.3:
  • Be selective about mapping font-dirs.xml in flatpak build.
  • Changes from version 1.16.2:
  • Support reinstalling bundle installations and Intel Xe VA-API.
  • Add cancellation support for curl downloads.
  • Fix font configuration, mask and pin configuration reloads, unintended home directory access, flatpak kill, OCI support, memory leaks and crashes.
  • Changes from version 1.16.1:
  • Allow updating existing apps under parental controls by default.
  • Use instance IDs for systemd scopes and include /dev/udmabuf with --device=dri.
  • Speed up prune --dry-run and permission-reset.
  • Support TLS certificates in /etc/containers/certs.d for OCI.
  • Fix portal crashes, sandbox environment handling, accessibility bus discovery, error reporting and shell completion.
  • Update documentation and translations.
Record
SUSE-SU-2026:4944-1
Updated
2026-11-02
OSVSUSE-SU-2026:5127-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
  • CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).
  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

  • Update to version 1.16.6 (jsc#PED-17048):
  • Fix file descriptor leaks affecting Chromium-based browsers.
  • Fix installing extra-data without a runtime, including OpenH264.
  • Ignore unusable sandbox-expose paths for portal sub-sandboxes, fixing Epiphany regressions.
  • Fix installed tests and handling of standard file descriptors passed as invalid flatpak run arguments.
  • Switch from Autotools to Meson, preserving system bubblewrap, xdg-dbus-proxy, curl and distribution-specific installation paths.
  • Require bubblewrap >= 0.10.0 and GPGME >= 1.8.0; add Meson, gettext, gtk-doc and polkit-agent build dependencies and drop obsolete intltool and libelf build dependencies.
  • Generate the system-user pre-script from the Meson build directory and package the tmpfiles configuration and renamed manual pages.
Record
SUSE-SU-2026:5127-1
Updated
2026-11-07

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flatpak
Debian:12
 All versions, plus listed versions
1.14.10-11.14.10-1~deb12u11.14.10-1~deb12u21.14.4-11.14.4-1+deb12u1
Show 45 moreShow less
1.14.4-1+deb12u1~bpo11+11.14.4-21.14.5-11.14.6-11.14.6-1~deb13u11.14.8-11.14.8-1~deb12u11.15.0-11.15.0-21.15.1-11.15.10-11.15.12-11.15.2-11.15.3-11.15.4-11.15.6-11.15.7-11.15.8-11.15.9-11.15.91-11.16.0-11.16.0-21.16.0-2~bpo12+11.16.1-11.16.1-1~bpo12+11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u11.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-11.18.1-1
 None known
flatpak
Debian:13
 before 1.16.6-1~deb13u2, plus listed versions
1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1
Show 7 moreShow less
1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+1
1.16.6-1~deb13u2
flatpak
Debian:14
 before 1.18.1-1, plus listed versions
1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1
Show 15 moreShow less
1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-1
1.18.1-1
flatpak
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 9 CVEs
 before 1.4.2-3.15.1
1.4.2-3.15.1
flatpak
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 9 CVEs
 before 1.4.2-3.15.1
1.4.2-3.15.1
flatpak
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 9 CVEs
 before 1.16.6-150600.3.12.1
1.16.6-150600.3.12.1
flatpak
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 9 CVEs
 before 1.16.6-150600.3.12.1
1.16.6-150600.3.12.1
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 9 CVEs
 before 1.16.6-150600.3.12.1
1.16.6-150600.3.12.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
flatpak
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1
Show 16 moreShow less
0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.31.0.9-0ubuntu0.41.0.9-0ubuntu0.4+esm1
 None known
flatpak
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-1
Show 6 moreShow less
1.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.31.6.5-0ubuntu0.41.6.5-0ubuntu0.51.6.5-0ubuntu0.5+esm1
 None known
flatpak
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.10.2-31.12.2-11.12.2-21.12.3-11.12.4-1
Show 5 moreShow less
1.12.5-11.12.6-11.12.7-11.12.7-1ubuntu0.11.12.7-1ubuntu0.1+esm1
 None known
flatpak
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.14.4-21.14.5-11.14.5-1build11.14.5-1build41.14.5-1build5
Show 4 moreShow less
1.14.5-1build61.14.6-11.14.6-1ubuntu0.11.14.6-1ubuntu0.1+esm1
 None known
flatpak
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.16.1-2ubuntu11.16.1-3ubuntu11.16.2-11.16.3-11.16.3-1build11.16.4-11.16.4-21.16.6-1
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affectedCVE List, NVD
factsEUVD
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-96281 is a medium vulnerability (CVSS 6.2) in Red Hat Enterprise Linux 10, published September 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. Fixed in flatpak 1.16.6-1~deb13u2.

References

Show 27 moreShow less
This page doesn't list everything

Left out here: 3 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open