8.4

CVE-2026-41049

Caching of Authentication allows Authentication Bypass between users in qSnapper

Incorrect caching of authentication between different users of the  qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions after a privileged users has authenticated for them.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Presire ≫ Qsnapper Version < 1.3.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.035
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SUSE 8.4 0 0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html#issue-auth-caching
Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1262218
Third Party Advisory
https://github.com/presire/qSnapper/releases/tag/v1.3.3
Third Party Advisory