CVE-2026-87876

LowCVSS 3.0/10Last modified Oct 21, 2026

Description

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Metrics

CVSS 3.1 3.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-178

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 9, 2026
Last modified: Oct 21, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-878777.7zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream CVE-2026-87887.3Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the set_add method were not checked for newli CVE-2026-878867.8Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Li CVE-2026-878888.0The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing CVE-2026-87898.1The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing CVE-2026-878905.3An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django CVE-2026-878916.5The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday sc CVE-2026-878925.3The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own se CVE-2026-878945.3The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's CVE-2026-878965.3The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking age CVE-2026-878989.4OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.CVE-2026-878999.4Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.