qSnapper CVE-2026-41049

Exploitation requires a local unprivileged session on a host running the qSnapper D-Bus system service at a version before 1.3.3, and crucially requires that a privileged (admin) user has previously completed a Polkit authentication for a qSnapper action on the same running service instance - the bug is that this prior authentication is implicitly carried over to other Polkit actions and other D-Bus callers. Limiting factors: attack vector is local only (AV:L, no network exposure), the attacker must already hold a valid local account (PR:L), the qSnapper D-Bus service must be installed and active, and the carry-over window depends on an admin actually having authenticated - on single-user systems or systems where no admin uses qSnapper, exploitation is not possible.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) and base score of 8.4 accurately reflect a high-impact local privilege escalation: an authenticated low-privileged local user can reach high confidentiality and integrity impact with no user interaction and no exotic attack requirements, but only after some privileged user on the same system has previously authenticated. There is no CISA KEV listing, no EPSS data provided, and no public exploit identified at time of analysis, so real-world exploitation pressure is currently low and largely bounded to multi-user Linux desktops or shared workstations where qSnapper is installed and admins occasionally authenticate. The dependency on a prior admin authentication is a meaningful limiter: this is not a drive-by root, but on long-running multi-user systems the precondition is realistic, so this should be treated as a genuine priority on affected hosts rather than a theoretical high-CVSS issue.

On a shared Linux workstation with qSnapper < 1.3.3 installed, an administrator authenticates once via Polkit to perform a routine snapshot operation. A logged-in unprivileged local user then invokes other qSnapper D-Bus methods from their own session and finds them accepted without re-authentication because the service treats the prior admin authentication as still valid, allowing them to read or manipulate snapshot data outside their privilege level.