Description (CNA)
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat Enterprise Linux 10 | affected |
| Red Hat / Red Hat Enterprise Linux 7 | affected |
| Red Hat / Red Hat Enterprise Linux 8 | affected |
| Red Hat / Red Hat Enterprise Linux 9 | affected |
CWE
CWE-862
References
- https://access.redhat.com/security/cve/CVE-2026-96283
- https://bugzilla.redhat.com/show_bug.cgi?id=2539424
- https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg
ADP enrichment
No English description supplied.
No references supplied.