{"id":"CVE-2026-96283","aliases":[],"cve":{"records":[{"id":"CVE-2026-96283","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T20:44:08.159Z","published":"2026-09-27T21:53:40.259Z","modified":"2026-11-06T20:01:19.230Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-06T20:01:19.230Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-28T13:34:26.766Z"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96283","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539424","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg","tags":[],"source":"redhat"}],"weaknesses":[{"id":"CWE-862","description":"Missing Authorization","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-28T13:32:31.877226Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull","titleSource":"redhat","descriptionSource":"redhat","description":"By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.","score":3.3,"severity":"low","published":"2026-09-27T21:53:40.259Z","modified":"2026-11-06T20:01:19.230Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:10"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96283"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96283"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96283"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96283"}],"remediation":[{"text":"No known mitigation other than updating.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96283"}],"references":["https://access.redhat.com/security/cve/CVE-2026-96283","https://bugzilla.redhat.com/show_bug.cgi?id=2539424","https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg"],"sources":[{"name":"CVE","id":"CVE-2026-96283","modified":"2026-11-06T20:01:19.230Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-96283"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","score":3.3}],"sourceAffected":[],"observedAt":"2026-11-06T22:20:06.215Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:00:31.976Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-07T00:25:34.079Z","attemptedAt":"2026-11-07T00:25:34.079Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-07T00:25:34.592Z","attemptedAt":"2026-11-07T00:25:34.592Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-07T00:25:33.914Z","attemptedAt":"2026-11-07T00:25:33.914Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-07T00:25:34.920Z","attemptedAt":"2026-11-07T00:25:34.920Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-88043","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88043","modified":"Nov 6, 2026, 8:01:19 PM","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","checkedAt":"2026-11-07T00:25:33.914Z"},{"source":"NVD","id":"CVE-2026-96283","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96283","modified":"2026-11-06T20:17:30.787","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","checkedAt":"2026-11-07T00:25:34.079Z"},{"source":"FIRST EPSS","id":"CVE-2026-96283","url":"https://www.first.org/epss/","probability":0.00106,"percentile":0.01125,"date":"2026-11-06","checkedAt":"2026-11-07T00:25:34.920Z"}],"aiSummary":{"text":"Flatpak's flatpak-system-helper allows cross-user cancellation of another user's ongoing pull, but it only removes the pull from internal tracking, making it impossible for the owning user to stop it. The vulnerability affects Red Hat Enterprise Linux 7, 8, 9, and 10. Local access is required to exploit the weakness, which is due to missing authorization.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T22:26:37.018Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-96283"}]}}