CVE-2026-41048

HighCVSS 7.1/10Last modified Jul 7, 2026

Description

Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.3 allowed a local attacker to use functions like "restore from snapshot" even if only allowed to do "delete snapshot".

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jun 22, 2026
Last modified: Jul 7, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-410497.1Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to CVE-2026-41056.7A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation o CVE-2026-410509.9Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-CVE-2026-410515.0csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories.CVE-2026-410528.8Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2 CVE-2026-410538.8Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principa CVE-2026-410547.8In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). Howe CVE-2026-410555.3WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSaf CVE-2026-410568.1WWBN AVideo is an open source video platform. In versions 29.0 and below, the `allowOrigin($allowAll=true)` function in `objects/functions.p CVE-2026-410577.1WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit `986e64aad` is incomplete CVE-2026-410588.1WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `deleteDump` parameter d CVE-2026-410598.2OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 have a configuration-depe