CVE-2026-41045

HighCVSS 7.0/10Last modified Oct 25, 2026

Description

A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass qSnappers authentication mechanism and operate e.g. as root user.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
presire	qSnapper	< 1.3.3

References

https://bugzilla.suse.com/show_bug.cgi?id=1261795Third Party Advisory
https://github.com/presire/qSnapper/releases/tag/v1.3.3Release Notes
https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html#issue-polkit-bypassThird Party Advisory

Timeline

Published: Jun 22, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-410467.3A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious confi CVE-2026-410475.5Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacker to see otherwise r CVE-2026-410487.1Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.3 allowed a local attacker to use functi CVE-2026-410497.1Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to CVE-2026-41056.7A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation o CVE-2026-410509.9Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-CVE-2026-410515.0csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories.CVE-2026-410528.8Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2 CVE-2026-410538.8Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principa CVE-2026-410547.8In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). Howe CVE-2026-410555.3WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSaf CVE-2026-410568.1WWBN AVideo is an open source video platform. In versions 29.0 and below, the `allowOrigin($allowAll=true)` function in `objects/functions.p