Which versions of PortProtonQt are affected by CVE-2026-59678?

PortProtonQt versions before 1.3.1 contain a local privilege escalation vulnerability with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-59678?

Within 24 hours, identify all systems running PortProtonQt and inventory which versions are deployed across your infrastructure. Within 7 days, deploy PortProtonQt version 1.3.1 or later to all affected systems through your standard patch management process, validating that Polkit authorization rules are properly updated. Within 30 days, complete rollout validation across all assets, remove older versions from official deployment sources, and document the remediation in your vulnerability management system.

PortProtonQt CVE-2026-59678

Q: What is the CVSS score of CVE-2026-59678?

CVE-2026-59678 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-47938 HIGH

Incorrect Authorization (CWE-863)

2026-07-22

GHSA-7h94-344f-429f

Authentication Bypass Suse

7.1

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Needs any local active session so AV:L/PR:L, spoofing the command line is trivial so AC:L; arbitrary mounts and network rewrites give I:H/A:H with limited data exposure C:L.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 08:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Jul 23, 2026 - 08:22 NVD

7.1 (HIGH)

Patch released

Jul 23, 2026 - 04:01 NVD

Source Code Evidence Fetched

Jul 22, 2026 - 16:20 vuln.today

Analysis Generated

Jul 22, 2026 - 16:20 vuln.today

CVE Published

Jul 22, 2026 - 16:00 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Local privilege escalation in PortProtonQt (the Qt-based front-end for the PortProton Linux gaming launcher) before commit 0d0f0950 lets any unprivileged local user gain root-equivalent control over storage and networking. The shipped Polkit rule authorized privileged udisks2 and NetworkManager actions by inspecting the caller's process command line via ps for the string "ppqtos", a check any user can trivially spoof to bypass authorization. There is no public exploit code and it is not in CISA KEV, but the vulnerable rule and its trivial bypass are fully disclosed in the advisory and patch, and the vendor has released a fix (version 1.3.1).

Technical ContextAI

The affected component is a Polkit (polkit-1) JavaScript authorization rule, ru.linux_gaming.PortProtonQt.rules, that governs three udisks2 filesystem actions (filesystem-mount-system, filesystem-mount-other-seat, filesystem-unmount-others) and the NetworkManager settings.modify.system action. The original rule attempted to restrict these privileges to the application by calling polkit.spawn(["ps", "-o", "args=", ...]) to read the requesting subject's (and its parent's) command line and returning polkit.Result.YES whenever that command line contained "ppqtos". This is a textbook CWE-863 Incorrect Authorization: process command lines are attacker-controllable identity signals, not trustworthy authentication, so basing an allow decision on them lets any process masquerade as the trusted application. The fix replaces command-line matching with proper subject attributes - requiring subject.local, subject.active, and subject.isInGroup("portprotonqt") - and provisions the portprotonqt group via a sysusers.d entry.

RemediationAI

Vendor-released patch: PortProtonQt 1.3.1 (fix commits https://github.com/Boria138/PortProtonQt/commit/f0ab40a2dab36ce91bc7e1b13d8d4ea220e5107c and https://github.com/Boria138/PortProtonQt/commit/71a8ebd89a503e692cdc6b40777e8cc22393c87b); upgrade to 1.3.1 or later, and after upgrading ensure the portprotonqt system group is created (via the new sysusers.d/portprotonqt.conf) and that only intended users are members, since privileged access is now gated on isInGroup("portprotonqt"). Consult the openSUSE advisory at https://security.opensuse.org/2026/07/22/port-proton-qt-polkit-rules.html and SUSE bug 1270218. If you cannot upgrade immediately, remove or neutralize the installed Polkit rule file build-aux/share/polkit-1/rules.d/ru.linux_gaming.PortProtonQt.rules (deleting it revokes the unsafe grant so udisks2/NetworkManager fall back to default Polkit prompts) - the trade-off is that PortProtonQt's automated mount and network features will require interactive administrator authentication; alternatively restrict local login to trusted users, noting this only reduces, not removes, exposure on multi-user hosts.