CVE-2026-96281
Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes
CVSS Score
6.2
EPSS Score
0.0%
EPSS Percentile
0th
On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities.
| CWE | CWE-284 |
| Vendor | red hat |
| Product | red hat enterprise linux 10 |
| Published | Sep 27, 2026 |
| Last Updated | Sep 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat enterprise linux 10
Be the first to know when new medium vulnerabilities affecting red hat red hat enterprise linux 10 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Attack Vector
Physical
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Red Hat / Red Hat Enterprise Linux 10
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected References
Credits
Upstream acknowledges Vivek Parikh (BreachX Zero Day Labs) as the original reporter.