Skip to main content

udisks2 CVE-2026-7867

| EUVDEUVD-2026-54277 HIGH
Incorrect Authorization (CWE-863)
2026-08-06 secalert@redhat.com
Privilege Escalation Authentication Bypass
7.8
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local low-privilege D-Bus access required; fstab 'user'/'users' condition is common enough on desktop Linux to warrant AC:L; full CIA reflects effective root-level control via mount namespace manipulation.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 06, 2026 - 22:39 vuln.today
Analysis Generated
Aug 06, 2026 - 22:39 vuln.today
CVE Published
Aug 06, 2026 - 22:18 nvd
HIGH 7.8

DescriptionCVE.org

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

AnalysisAI

Local privilege escalation in udisks2 exploits insufficient polkit authorization on the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method, allowing a low-privileged user with an active console session to spoof the 'as-user' parameter and mount filesystems on behalf of arbitrary users, including root. The attack specifically leverages fstab entries carrying 'user' or 'users' mount options, which are common on desktop Linux installations, to bypass the authorization check entirely. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Gain low-privilege console session
Delivery
Connect to org.freedesktop.UDisks2 via D-Bus
Exploit
Craft Filesystem.Mount() call with spoofed 'as-user' targeting privileged account
Install
Bypass polkit via fstab 'user'/'users' condition
C2
Mount filesystem into privileged user's namespace
Execute
Plant malicious payload at privileged mount path
Impact
Execute code or escalate to target account
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all three of the following conditions: (1) a local user account with an active console session - the CVSS AV:L/PR:L vector confirms local low-privilege access as the entry point, and the polkit 'active session' check typically requires a graphical or physical console session rather than a background SSH connection; (2) at least one /etc/fstab entry carrying the 'user' or 'users' mount option for any filesystem - this is the specific prerequisite identified in the upstream release notes and is the configuration condition the exploit directly leverages to bypass polkit; (3) an unpatched udisks2 daemon running and accessible via D-Bus on the target system. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 7.8 HIGH with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent and accurately reflects the attack profile: local access is required, privileges are low (any unprivileged account suffices), no user interaction is needed, and successful exploitation yields full CIA impact through effective root-level control via mount namespace manipulation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A low-privileged local user with an active console session on a standard Linux desktop opens a D-Bus connection to org.freedesktop.UDisks2 and calls Filesystem.Mount() with the 'as-user' parameter set to a privileged account such as root; because a USB drive or network share in /etc/fstab carries the 'users' option, the daemon skips the full polkit authorization check and mounts the filesystem into the privileged user's mount namespace. The attacker then plants a malicious binary or configuration file at a path that the privileged user's processes will traverse, achieving code execution or credential theft under the target account. …
Remediation The primary remediation is upgrading to udisks 2.11.2, which contains the authorization fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all systems running udisks2, prioritize desktop and workstation assets, and initiate staged deployment of udisks 2.11.2. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2026-7867 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy