What is the CVSS score of CVE-2026-41045?

CVE-2026-41045 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of qSnapper are affected by CVE-2026-41045?

presire qSnapper versions before 1.3.3 contain a local privilege escalation that allows system users with local access to bypass authorization controls and perform critical file-recovery operations…. A patch is available.

How to fix or mitigate CVE-2026-41045?

Within 24 hours: Identify systems running presire qSnapper before version 1.3.3 and assess local user access scope. Within 7 days: Upgrade all affected systems to presire qSnapper 1.3.3. Within 30 days: Verify patch deployment and confirm that authorization controls for snapshot-recovery operations are functioning correctly.

qSnapper CVE-2026-41045

EUVD-2026-38259 HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-05-27

GHSA-w4qv-m9pp-3xjr

Apache Kubernetes SSRF Suse Qsnapper Presire

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local D-Bus reachability gives AV:L; a low-privileged local account is needed (PR:L); winning the PID-reuse race makes it AC:H; success yields full root C:H/I:H/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 28, 2026 - 00:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 28, 2026 - 00:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 28, 2026 - 00:22 vuln.today

cvss_changed

CVSS changed

Jun 28, 2026 - 00:22 NVD

8.1 (HIGH) 7.0 (HIGH)

Patch available

Jun 22, 2026 - 17:01 EUVD

Source Code Evidence Fetched

Jun 22, 2026 - 16:53 vuln.today

Analysis Generated

Jun 22, 2026 - 16:53 vuln.today

CVSS changed

Jun 22, 2026 - 16:52 NVD

8.1 (HIGH)

CVE Published

May 27, 2026 - 20:45 oss-security

HIGH 8.1

CVE Published

May 27, 2026 - 20:45 nvd

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Local privilege escalation in presire qSnapper before 1.3.3 lets a low-privileged user bypass Polkit authentication in the privileged D-Bus service by exploiting a PID-reuse race in the UnixProcessSubject authorization check. A successful race grants the attacker the authority of a privileged process, exposing high-impact root-level operations (snapshot/file restore) on the host. EPSS is low (0.13%, 3rd percentile) and no public exploit is identified; the issue was found in a coordinated SUSE security review and fixed in v1.3.3.

Technical ContextAI

qSnapper is a Qt-based snapshot management front-end (cpe:2.3:a:presire:qsnapper) that exposes privileged operations through a root D-Bus service guarded by Polkit. The flaw is a CWE-367 time-of-check/time-of-use race: the service identified the calling client with Polkit's UnixProcessSubject, which is keyed on a PID. Because PIDs are recycled by the kernel, an attacker can cause the PID inspected at authorization time to differ from the process that actually issued the call, so a privileged authorization decision is attributed to an unprivileged caller. The vendor fix replaces UnixProcessSubject with SystemBusNameSubject (a stable D-Bus connection name not subject to PID reuse) and additionally removes a cached m_authenticated flag, relying on Polkit's native auth_admin_keep behavior.

RemediationAI

Vendor-released patch: upgrade to qSnapper 1.3.3, which closes the PID-reuse race by switching Polkit checkAuthorization() from UnixProcessSubject to SystemBusNameSubject and removing the cached authentication state (see https://github.com/presire/qSnapper/releases/tag/v1.3.3 and https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html#issue-polkit-bypass). If immediate upgrade is not possible, the most effective compensating control is to disable or stop the privileged qSnapper D-Bus service and remove its Polkit policy so no authorization path is reachable, accepting that snapshot/restore functionality becomes unavailable until patched; alternatively restrict who can reach the D-Bus interface by limiting local interactive/login accounts on hosts where the service runs, accepting that this only reduces the attacker population rather than fixing the race. Because v1.3.3 also addresses companion issues (CVE-2026-41046 through 41049), patching is strongly preferred over partial mitigations.