CVE-2026-96283

LOWCVSS 3.3

Description

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

Timeline

Published:September 27th, 2026 10:17 PM

Last modified:September 29th, 2026 9:29 PM

CVSS Scoring

CVSS v3: 3.3 (LOW)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-862

References & Reports

Advisories, patches, and third-party reports

https://access.redhat.com/security/cve/CVE-2026-96283
https://bugzilla.redhat.com/show_bug.cgi?id=2539424
https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg

Source: NIST NVD · Data may lag official sources by up to one minute