{"id":"CVE-2026-7867","aliases":["ALSA-2026:53435","DEBIAN-CVE-2026-7867","EUVD-2026-54277","GHSA-j42g-v9jw-6ph3","MGASA-2026-0453","OESA-2026-3460","OESA-2026-3461","OESA-2026-3462","RHSA-2026:53435","RHSA-2026:64798","RLSA-2026:53435","SUSE-SU-2026:23405-1","SUSE-SU-2026:23575-1","UBUNTU-CVE-2026-7867","USN-8701-1","openSUSE-SU-2026:11501-1","openSUSE-SU-2026:21704-1"],"status":"published","title":"Udisks2: udisks2: local privilege escalation via as-user option spoofing","description":"A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00168,"percentile":0.06215,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-863"],"published":"2026-08-06T15:36:02Z","modified":"2026-11-05T00:17:29Z","exploits":[{"source":"pocgithub","id":"azqzazq1/CVE-2026-7867-disk2root","title":"azqzazq1/CVE-2026-7867-disk2root","date":"2026-05-08","url":"https://github.com/azqzazq1/CVE-2026-7867-disk2root"}],"fixes":[{"ecosystem":"AlmaLinux:10","package":"libudisks2","fixed_in":["2.11.0-2.el10_2.1.alma.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libudisks2-devel","fixed_in":["2.11.0-2.el10_2.1.alma.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"udisks2","fixed_in":["2.11.0-2.el10_2.1.alma.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"udisks2-iscsi","fixed_in":["2.11.0-2.el10_2.1.alma.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"udisks2-lsm","fixed_in":["2.11.0-2.el10_2.1.alma.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"udisks2-lvm2","fixed_in":["2.11.0-2.el10_2.1.alma.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"udisks2","fixed_in":["2.10.1-12.1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"udisks2","fixed_in":["2.11.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"udisks2","fixed_in":["2.10.1-3.1.mga10"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"udisks2","fixed_in":["2.10.1-10.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"udisks2","fixed_in":["2.10.1-10.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"udisks2","fixed_in":["2.10.1-10.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libudisks2","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libudisks2-debuginfo","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-debuginfo","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-debugsource","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-iscsi","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-iscsi-debuginfo","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-lsm","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-lsm-debuginfo","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-lvm2","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-lvm2-debuginfo","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libudisks2-devel","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libudisks2","fixed_in":["0:2.10.90-5.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libudisks2-debuginfo","fixed_in":["0:2.10.90-5.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2","fixed_in":["0:2.10.90-5.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-debuginfo","fixed_in":["0:2.10.90-5.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-debugsource","fixed_in":["0:2.10.90-5.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-iscsi","fixed_in":["0:2.10.90-5.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-iscsi-debuginfo","fixed_in":["0:2.10.90-5.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-lsm","fixed_in":["0:2.10.90-5.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-lsm-debuginfo","fixed_in":["0:2.10.90-5.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-lvm2","fixed_in":["0:2.10.90-5.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-lvm2-debuginfo","fixed_in":["0:2.10.90-5.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libudisks2-devel","fixed_in":["0:2.10.90-5.el10_0.3"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"udisks2","fixed_in":["0:2.11.0-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"udisks2","fixed_in":["2.10.1-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"udisks2","fixed_in":["2.10.1-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"udisks2","fixed_in":["2.10.1-160000.4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"udisks2","fixed_in":["2.10.1-6ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"udisks2","fixed_in":["2.10.91-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"udisks2","fixed_in":["2.11.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"udisks2","fixed_in":["2.10.1-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"libudisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-2.el10_2.1.alma.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libudisks2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-2.el10_2.1.alma.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-2.el10_2.1.alma.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"udisks2-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-2.el10_2.1.alma.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"udisks2-lsm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-2.el10_2.1.alma.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"udisks2-lvm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-2.el10_2.1.alma.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-12.1+deb13u2"}]}],"versions":["2.10.1-12.1","2.10.1-12.1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-1"}]}],"versions":["2.10.1-12.1","2.10.90-1","2.10.90-2","2.10.90-3","2.10.90-3.1","2.10.91-1","2.11.0-1","2.11.0-2","2.11.1-1","2.11.1-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-3.1.mga10"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-10.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-10.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-10.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libudisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libudisks2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-iscsi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-lsm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-lsm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-lvm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"udisks2-lvm2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libudisks2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libudisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.90-5.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libudisks2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.90-5.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.90-5.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.90-5.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.90-5.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.90-5.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-iscsi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.90-5.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-lsm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.90-5.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-lsm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.90-5.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-lvm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.90-5.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"udisks2-lvm2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.90-5.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libudisks2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.90-5.el10_0.3"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-160000.4.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-6ubuntu1.5"}]}],"versions":["2.10.1-1ubuntu1","2.10.1-1ubuntu2","2.10.1-6","2.10.1-6build1","2.10.1-6ubuntu1","2.10.1-6ubuntu1.2","2.10.1-6ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.91-1ubuntu2.1"}]}],"versions":["2.10.1-12.1ubuntu2","2.10.91-1ubuntu1","2.10.91-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-6ubuntu1.5"}]}],"versions":["2.10.1-1ubuntu1","2.10.1-1ubuntu2","2.10.1-6","2.10.1-6build1","2.10.1-6ubuntu1","2.10.1-6ubuntu1.2","2.10.1-6ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.91-1ubuntu2.1"}]}],"versions":["2.10.1-12.1ubuntu2","2.10.91-1ubuntu1","2.10.91-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"udisks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-160000.4.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:53435","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:64798","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7867","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466747","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/storaged-project/udisks/releases/tag/udisks-2.11.2","tags":["web","article"]},{"url":"https://github.com/storaged-project/udisks/security/advisories/GHSA-j42g-v9jw-6ph3","tags":["advisory","article","report"]},{"url":"https://bugzilla.redhat.com/2466747","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-53435.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7867.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7867","tags":["advisory"]},{"url":"https://github.com/storaged-project/udisks","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-7867","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0453.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36173","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00325.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8701-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3460","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3461","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3462","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53435.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7867","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64798.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:53435","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623405-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274430","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7867","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623575-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-7867","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-7867","title":"Udisks2: udisks2: local privilege escalation via as-user option spoofing","description":"A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.","status":"published","published":"2026-08-06T15:36:02.76Z","modified":"2026-09-08T07:56:39.578Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:20:06.216584Z"}],"euvd":[{"id":"EUVD-2026-54277","description":"A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.","status":"published","published":"2026-08-06T15:36:02Z","modified":"2026-09-08T07:56:39Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:30.317832Z"}],"nvd":[{"id":"CVE-2026-7867","description":"A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.","status":"published","published":"2026-08-06T22:18:33.1Z","modified":"2026-11-05T00:17:29.72Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-05T01:45:10.513148Z"}],"osv":[{"id":"CVE-2026-7867","title":"Udisks2: udisks2: local privilege escalation via as-user option spoofing","description":"A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.","status":"published","published":"2026-08-06T15:36:02.76Z","modified":"2026-11-10T17:27:19.394912271Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-10T17:34:47.901646Z"},{"id":"DEBIAN-CVE-2026-7867","description":"A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.","status":"published","published":"2026-08-06T22:18:33.1Z","modified":"2026-11-05T09:47:26.896435731Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:49.170436Z"},{"id":"OESA-2026-3460","title":"udisks2 security update","description":"The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the \u0026apos;as-user\u0026apos; option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the \u0026apos;as-user\u0026apos; parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.(CVE-2026-7867)","status":"published","published":"2026-08-20T10:00:07Z","modified":"2026-08-20T10:15:15.02865872Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3461","title":"udisks2 security update","description":"The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the \u0026apos;as-user\u0026apos; option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the \u0026apos;as-user\u0026apos; parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.(CVE-2026-7867)","status":"published","published":"2026-08-20T10:00:08Z","modified":"2026-08-20T10:15:14.074077829Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3462","title":"udisks2 security update","description":"The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the \u0026apos;as-user\u0026apos; option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the \u0026apos;as-user\u0026apos; parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.(CVE-2026-7867)","status":"published","published":"2026-08-20T10:00:10Z","modified":"2026-08-20T10:15:15.428413484Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:53435","title":"Red Hat Security Advisory: udisks2 security update","status":"published","published":"2026-08-12T10:16:30Z","modified":"2026-09-08T10:16:23Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:64798","title":"Red Hat Security Advisory: udisks2 security update","status":"published","published":"2026-09-08T10:19:08Z","modified":"2026-09-08T10:32:34.505757727Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:53435","title":"Important: udisks2 security update","description":"The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.\n\nSecurity Fix(es):\n\n* udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-12T12:08:21.56722Z","modified":"2026-08-12T12:30:04.225447394Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-7867","description":"A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.","status":"published","published":"2026-08-06T22:18:00Z","modified":"2026-08-31T22:15:55.390282945Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"ALSA-2026:53435","title":"Important: udisks2 security update","description":"The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.  \n\nSecurity Fix(es):  \n\n  * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-11T00:00:00Z","modified":"2026-10-29T11:30:38.955526496Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"MGASA-2026-0453","title":"Updated udisks2 package fixes a security vulnerability","description":"Local privilege escalation via as-user option spoofing. (CVE-2026-7867)\n","status":"published","published":"2026-09-25T16:24:58Z","modified":"2026-09-25T16:30:03.410943642Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11501-1","title":"libudisks2-0-2.11.2-1.1 on GA media","description":"These are all security issues fixed in the libudisks2-0-2.11.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-11T00:00:00Z","modified":"2026-08-12T10:45:07.676381742Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21704-1","title":"Security update for udisks2","description":"This update for udisks2 fixes the following issue:\n\n- CVE-2026-7867: insufficient authorization checks on the `as-user` option in the\n  `org.freedesktop.UDisks2.Filesystem.Mount()` D-Bus method can lead to local privilege escalation (bsc#1274430).\n","status":"published","published":"2026-08-30T15:20:51Z","modified":"2026-08-31T18:15:04.198253185Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23405-1","title":"Security update for udisks2","description":"This update for udisks2 fixes the following issue:\n\n- CVE-2026-7867: insufficient authorization checks on the `as-user` option in the\n  `org.freedesktop.UDisks2.Filesystem.Mount()` D-Bus method can lead to local privilege escalation (bsc#1274430).\n","status":"published","published":"2026-08-30T15:21:09Z","modified":"2026-09-10T18:23:15.354339014Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23575-1","title":"Security update for udisks2","description":"This update for udisks2 fixes the following issue:\n\n- CVE-2026-7867: insufficient authorization checks on the `as-user` option in the\n  `org.freedesktop.UDisks2.Filesystem.Mount()` D-Bus method can lead to local privilege escalation (bsc#1274430).\n","status":"published","published":"2026-08-30T15:21:09Z","modified":"2026-09-29T18:23:09.505871092Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"USN-8701-1","title":"udisks2 vulnerability","description":"It was discovered that UDisks did not correctly validate the caller\nidentity when handling the as-user option in the\norg.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. A local attacker\nwith an active console session could possibly use this issue to mount\nfilesystems on behalf of arbitrary users, including privileged accounts,\nleading to local privilege escalation.","status":"published","published":"2026-08-31T12:24:24Z","modified":"2026-08-31T22:26:26.938977178Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}