{"id":"CVE-2026-96281","aliases":[],"cve":{"records":[{"id":"CVE-2026-96281","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T20:43:45.571Z","published":"2026-09-27T21:00:17.262Z","modified":"2026-11-06T02:14:19.696Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-06T02:14:19.696Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-30T20:11:12.558Z"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96281","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539421","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-q4gr-vc25-57m5","tags":[],"source":"redhat"}],"weaknesses":[{"id":"CWE-284","description":"Improper Access Control","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-30T19:41:13.507053Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes","titleSource":"redhat","descriptionSource":"redhat","description":"On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities.","score":6.2,"severity":"medium","published":"2026-09-27T21:00:17.262Z","modified":"2026-11-06T02:14:19.696Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:10"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96281"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96281"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96281"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96281"}],"remediation":[{"text":"Ensure that Flatpak apps installed system-wide are fully updated before running them.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96281"}],"references":["https://access.redhat.com/security/cve/CVE-2026-96281","https://bugzilla.redhat.com/show_bug.cgi?id=2539421","https://github.com/flatpak/flatpak/security/advisories/GHSA-q4gr-vc25-57m5"],"sources":[{"name":"CVE","id":"CVE-2026-96281","modified":"2026-11-06T02:14:19.696Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-96281"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","score":6.2}],"sourceAffected":[],"observedAt":"2026-11-06T03:17:09.158Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T21:25:33.720Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-06T03:20:34.563Z","attemptedAt":"2026-11-06T03:20:34.563Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-06T03:20:34.761Z","attemptedAt":"2026-11-06T03:20:34.761Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T03:20:35.242Z","attemptedAt":"2026-11-06T03:20:35.242Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-06T03:20:34.528Z","attemptedAt":"2026-11-06T03:20:34.528Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-96281","url":"https://www.first.org/epss/","probability":0.00124,"percentile":0.02127,"date":"2026-11-05","checkedAt":"2026-11-06T03:20:34.528Z"},{"source":"NVD","id":"CVE-2026-96281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96281","modified":"2026-11-06T03:16:48.483","score":6.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","checkedAt":"2026-11-06T03:20:34.563Z"},{"source":"ENISA EUVD","id":"EUVD-2026-88027","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88027","modified":"Nov 6, 2026, 2:14:19 AM","score":6.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","checkedAt":"2026-11-06T03:20:35.242Z"}],"aiSummary":{"text":"A local user with an active login session can bypass anti-downgrade checks for system Flatpak apps, potentially exposing other users to older versions with vulnerabilities. The weakness is due to improper access control. Affected products include Red Hat Enterprise Linux 7, 8, 9, and 10.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T03:21:02.488Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-96281"}]}}