EUVD-2026-38267
GHSA-rv65-qg4j-mcmv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local D-Bus access required with no privileges; confidentiality-only impact as attackers read but cannot modify snapshot diff data.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
3DescriptionCVE.org
Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacker to see otherwise read protected information.
AnalysisAI
Unauthenticated local access to qSnapper's D-Bus snapshot diff interface before version 1.3.3 exposes read-protected file contents to any local user on the host. The 'snapshot diff' D-Bus methods - GetFileChanges, GetFileChangesBetween, GetFileDiffBetween, and GetFileDiffAndDetails - lacked any Polkit authorization check, meaning a local unprivileged caller could invoke them directly and receive sensitive file diff data. This is one of five authentication/authorization flaws (CVE-2026-41045 through CVE-2026-41049) discovered and reported by the SUSE security team under coordinated disclosure; no public exploit is identified at time of analysis.
Technical ContextAI
qSnapper is a Linux snapshot management application by presire that exposes its core functionality through a D-Bus service interface. The affected operations are the snapshot comparison and diff retrieval methods: GetFileChanges, GetFileChangesBetween, GetFileDiffBetween, and GetFileDiffAndDetails. These methods were callable on the D-Bus without triggering any Polkit authorization, making the protected snapshot data accessible to any local user who could address the service. The root cause is CWE-306 (Missing Authentication for Critical Function) - the methods simply had no authorization gate. The fix in v1.3.3 (P1 commit) introduced a dedicated Polkit action com.presire.qsnapper.view-diff with auth_admin_keep enforcement, gating all four methods behind admin-level authentication. All presire qSnapper releases prior to 1.3.3 are affected per CPE cpe:2.3:a:presire:qsnapper:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: qSnapper 1.3.3, available at https://github.com/presire/qSnapper/releases/tag/v1.3.3. Upgrading to v1.3.3 is the definitive fix; the release introduces a dedicated Polkit action com.presire.qsnapper.view-diff with auth_admin_keep enforcement, ensuring that GetFileChanges, GetFileChangesBetween, GetFileDiffBetween, and GetFileDiffAndDetails all require admin authentication before returning data. As a compensating control prior to patching, administrators can restrict access to the qSnapper D-Bus methods at the D-Bus policy level by adding deny rules for non-root users targeting the affected interface - note this will prevent legitimate snapshot diff viewing for all non-admin users and may break dependent tooling. Additionally, reducing the number of local user accounts on hosts running qSnapper limits the pool of potential local attackers.
Authentication bypass in qSnapper's privileged D-Bus service (versions before 1.3.3) allows any local unprivileged user
Local privilege escalation in qSnapper D-Bus service before version 1.3.3 allows any unprivileged local user to invoke p
Local privilege escalation and denial of service in qSnapper before 1.3.3 stems from path traversal via the configName D
Local privilege escalation in presire qSnapper before 1.3.3 lets a low-privileged user bypass Polkit authentication in t
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today