{"id":"CVE-2026-96283","aliases":["DEBIAN-CVE-2026-96283","EUVD-2026-88043","OESA-2026-4308","OESA-2026-4309","OESA-2026-4310","OESA-2026-4311","SUSE-SU-2026:4610-1","UBUNTU-CVE-2026-96283"],"status":"published","title":"Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull","description":"By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00106,"percentile":0.01122,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-09-27T21:53:40Z","modified":"2026-10-16T12:15:18Z","fixes":[{"ecosystem":"Debian:12","package":"flatpak","fixed_in":["1.14.10-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flatpak","fixed_in":["1.16.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flatpak","fixed_in":["1.16.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.10-1~deb12u2"}]}],"versions":["1.14.10-1~deb12u1","1.14.4-1","1.14.4-1+deb12u1","1.14.4-1+deb12u1~bpo11+1","1.14.4-2","1.14.5-1","1.14.6-1","1.14.6-1~deb13u1","1.14.8-1","1.14.8-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4-1"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4-1"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-15.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-15.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-15.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-15.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.7-5","0.10.0-1","0.10.0-2","0.10.1-1","0.10.2-1","0.10.2.1-1","0.10.2.1-2","0.10.3-1","0.11.1-0ubuntu1","0.11.3-2","0.11.3-3","0.11.7-0ubuntu0.1","1.0.1-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.18.04.1","1.0.8-0ubuntu0.18.04.1","1.0.9-0ubuntu0.1","1.0.9-0ubuntu0.2","1.0.9-0ubuntu0.3","1.0.9-0ubuntu0.4","1.0.9-0ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.3-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.5-0ubuntu0.1","1.6.5-0ubuntu0.2","1.6.5-0ubuntu0.3","1.6.5-0ubuntu0.4","1.6.5-0ubuntu0.5","1.6.5-0ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.2-3","1.12.2-1","1.12.2-2","1.12.3-1","1.12.4-1","1.12.5-1","1.12.6-1","1.12.7-1","1.12.7-1ubuntu0.1","1.12.7-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.4-2","1.14.5-1","1.14.5-1build1","1.14.5-1build4","1.14.5-1build5","1.14.5-1build6","1.14.6-1","1.14.6-1ubuntu0.1","1.14.6-1ubuntu0.1+esm1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96283","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539424","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-96283","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4308","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96283","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4309","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4310","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4311","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264610-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280236","tags":["report"]},{"url":"https://bugzilla.suse.com/1282514","tags":["report"]},{"url":"https://bugzilla.suse.com/1282515","tags":["report"]},{"url":"https://bugzilla.suse.com/1282516","tags":["report"]},{"url":"https://bugzilla.suse.com/1282519","tags":["report"]},{"url":"https://bugzilla.suse.com/1282520","tags":["report"]},{"url":"https://bugzilla.suse.com/1282521","tags":["report"]},{"url":"https://bugzilla.suse.com/1282523","tags":["report"]},{"url":"https://bugzilla.suse.com/1282524","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96808","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-96283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96283","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-96283","title":"Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull","description":"By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.","status":"published","published":"2026-09-27T21:53:40.259Z","modified":"2026-11-06T20:01:19.23Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-06T21:31:08.131839Z"}],"euvd":[{"id":"EUVD-2026-88043","description":"By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.","status":"published","published":"2026-09-27T21:53:40Z","modified":"2026-11-06T20:01:19Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-06T21:07:00.111123Z"}],"nvd":[{"id":"CVE-2026-96283","description":"By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.","status":"published","published":"2026-09-27T22:17:06.557Z","modified":"2026-11-06T20:17:30.787Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-06T22:02:13.943945Z"}],"osv":[{"id":"DEBIAN-CVE-2026-96283","description":"By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.","status":"published","published":"2026-09-27T22:17:06.557Z","modified":"2026-11-07T09:47:23.66033883Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"OESA-2026-4308","title":"flatpak security update","description":"flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\r\n\r\nSecurity Fix(es):\n\nA malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)\n\nBy calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user\u0026apos;s pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)","status":"published","published":"2026-10-16T11:59:12Z","modified":"2026-10-16T12:15:18.163234345Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4309","title":"flatpak security update","description":"flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\r\n\r\nSecurity Fix(es):\n\nA malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)\n\nBy calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user\u0026apos;s pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)","status":"published","published":"2026-10-16T11:59:12Z","modified":"2026-10-16T12:15:18.161810566Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4310","title":"flatpak security update","description":"flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\r\n\r\nSecurity Fix(es):\n\nA malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)\n\nBy calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user\u0026apos;s pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)","status":"published","published":"2026-10-16T11:59:12Z","modified":"2026-10-16T12:15:18.1676392Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4311","title":"flatpak security update","description":"flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\r\n\r\nSecurity Fix(es):\n\nA malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)\n\nBy calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user\u0026apos;s pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)","status":"published","published":"2026-10-16T11:59:13Z","modified":"2026-10-16T12:15:08.480934835Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-96283","description":"By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.","status":"published","published":"2026-09-27T22:17:00Z","modified":"2026-10-01T00:22:43.108858033Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"SUSE-SU-2026:4610-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access\n  to files on the host (bsc#1280236).\n- CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514).\n- CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).\n- CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516).\n- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).\n- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).\n- CVE-2026-96283: flatpak-system-helper: cross-user `CancelPull` orphans another user's ongoing pull (bsc#1282521).\n- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523).\n- CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering\n  (bsc#1282524).\n","status":"published","published":"2026-10-09T15:55:00Z","modified":"2026-10-10T09:30:06.446561391Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}