{"id":"CVE-2026-93676","aliases":["AZL-105116","DEBIAN-CVE-2026-93676","EUVD-2026-82937","MGASA-2026-0446","UBUNTU-CVE-2026-93676","openSUSE-SU-2026:11873-1","openSUSE-SU-2026:11913-1"],"status":"published","title":"Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks","description":"xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.","severity":{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00144,"percentile":0.0375,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2026-09-18T14:19:34Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:13","package":"xdg-dbus-proxy","fixed_in":["0.1.6-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xdg-dbus-proxy","fixed_in":["0.1.8-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"xdg-dbus-proxy","fixed_in":["0.1.8-1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"xdg-dbus-proxy","fixed_in":["0.1.8-1.mga9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.1.6-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6-1+deb13u2"}]}],"versions":["0.1.6-1","0.1.6-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.8-1"}]}],"versions":["0.1.6-1","0.1.6-2","0.1.7-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.8-1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.8-1.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.1-1","0.1.2-1","0.1.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.2-2build1","0.1.3-1","0.1.3-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.5-1","0.1.5-1build1","0.1.5-1build2","0.1.5-1ubuntu0.1","0.1.5-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.6-1","0.1.6-2","0.1.7-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9-1.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93676","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537014","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/22/24"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93676","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-93676","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0446.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36136","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/11/10","tags":["web"]},{"url":"https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-r7hp-698j-2h6c","tags":["advisory","report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00346.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-93676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93676","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94422","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-93676","title":"Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks","description":"xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.","status":"published","published":"2026-09-18T14:19:34.528Z","modified":"2026-09-22T23:07:03.845Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-82937","description":"xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.","status":"published","published":"2026-09-18T14:19:34Z","modified":"2026-09-22T23:07:03Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T17:28:01.71506Z"}],"nvd":[{"id":"CVE-2026-93676","description":"xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.","status":"published","published":"2026-09-18T15:17:22.813Z","modified":"2026-09-22T23:17:08.413Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:49.70655Z"}],"osv":[{"id":"DEBIAN-CVE-2026-93676","description":"xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.","status":"published","published":"2026-09-18T15:17:22.813Z","modified":"2026-09-23T08:47:35.530934663Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"UBUNTU-CVE-2026-93676","description":"xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.","status":"published","published":"2026-09-18T15:17:00Z","modified":"2026-09-23T23:40:09Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"AZL-105116","title":"CVE-2026-93676 affecting package xdg-dbus-proxy 0.1.6-2","description":"xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.","status":"published","published":"2026-09-18T15:17:22Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"MGASA-2026-0446","title":"Updated xdg-dbus-proxy packages fix security vulnerabilities","description":"filtering for broadcast messages bypassing path/interface/member checks\n","status":"published","published":"2026-09-24T02:02:40Z","modified":"2026-09-24T02:15:05.012787765Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11873-1","title":"flatpak-1.18.3-1.1 on GA media","description":"These are all security issues fixed in the flatpak-1.18.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-25T18:23:08.574862627Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11913-1","title":"xdg-dbus-proxy-0.1.9-1.1 on GA media","description":"These are all security issues fixed in the xdg-dbus-proxy-0.1.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-28T00:00:00Z","modified":"2026-09-29T18:23:22.927334408Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}