EUVD-2026-38275
GHSA-cf66-c678-24r2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local D-Bus service requires an existing low-privileged local account (AV:L, PR:L); no user interaction or special conditions beyond a prior admin auth; yields high confidentiality and integrity over snapshots, no availability impact.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
3DescriptionCVE.org
Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions after a privileged users has authenticated for them.
AnalysisAI
Local privilege escalation in qSnapper D-Bus service before version 1.3.3 allows any unprivileged local user to invoke privileged D-Bus methods after an administrator has previously authenticated for an unrelated Polkit action. The flaw stems from authentication state being implicitly carried over across different Polkit actions and users rather than being scoped per-action-per-caller, enabling unauthorized snapshot management on systems where the service is installed. No public exploit identified at time of analysis, though SUSE published a coordinated disclosure advisory alongside the upstream fix.
Technical ContextAI
qSnapper is a Qt-based snapshot management front-end (CPE cpe:2.3:a:presire:qsnapper) that exposes a system D-Bus service backed by Polkit for authorization of privileged snapshot operations. CWE-303 (Incorrect Implementation of Authentication Algorithm) here manifests as implicit carry-over of authentication results between distinct Polkit actions: a successful auth_admin check for one action (e.g. snapshot management) was treated as sufficient for unrelated actions invoked subsequently by other callers, rather than each Polkit action being independently authorized for the calling D-Bus subject. The upstream fix in v1.3.3 eliminates the m_authenticated cache and the explicit Authenticate() D-Bus method, instead relying on Polkit's native auth_admin_keep behavior scoped per action, and introduces a dedicated com.presire.qsnapper.view-diff action so diff/list operations are no longer covered by the broader admin grant.
RemediationAI
Vendor-released patch: qSnapper 1.3.3 - upgrade to this version, which removes the m_authenticated cache and the explicit Authenticate() D-Bus method and relies on Polkit's native per-action auth_admin_keep semantics, per the release notes at https://github.com/presire/qSnapper/releases/tag/v1.3.3 and the SUSE advisory at https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html#issue-auth-caching. Where immediate upgrade is not possible, compensating controls include stopping and masking the qSnapper system D-Bus service (systemctl stop/mask) on multi-user hosts, restricting Polkit rules so that snapshot-related actions require auth_admin (not auth_admin_keep) and never yes for non-admin users, and limiting interactive admin authentication on shared systems so that no carry-over window is available to local users; each of these breaks the qSnapper GUI workflow for end-users and is intended as a stop-gap only.
Authentication bypass in qSnapper's privileged D-Bus service (versions before 1.3.3) allows any local unprivileged user
Local privilege escalation and denial of service in qSnapper before 1.3.3 stems from path traversal via the configName D
Local privilege escalation in presire qSnapper before 1.3.3 lets a low-privileged user bypass Polkit authentication in t
Unauthenticated local access to qSnapper's D-Bus snapshot diff interface before version 1.3.3 exposes read-protected fil
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today