Pardus About CVE-2026-8304

Exploitation requires a valid local user account on a Pardus Linux system with Pardus About installed at a version between 1.2.1 and 1.2.4 inclusive. The attacker must be able to execute the Pardus About application in a local session. No network access, special configuration, elevated account, or interaction from another user is required beyond a low-privileged local login. Exploitation is entirely limited to local attack surface (AV:L); systems where no untrusted users hold local accounts are not at meaningful risk.

The CVSS 3.1 score of 5.5 (Medium) reflects a local-only attack surface (AV:L), low privilege requirement (PR:L), and high confidentiality impact (C:H) with no integrity or availability consequences - the overall profile of a local authorization bypass that leaks sensitive read-only information. No EPSS probability, KEV listing, or proof-of-concept has been provided or identified at time of analysis, which significantly limits urgency relative to remotely exploitable issues. The threat is bounded to systems where untrusted users hold local accounts, meaning single-user workstations or tightly controlled kiosks carry negligible risk. The 'Authentication Bypass' tag applied to this CVE is a mislabel; CWE-862 is a missing authorization check after authentication has already occurred, not a bypass of the authentication mechanism itself. Patching to 1.2.5 is the appropriate response during routine maintenance cycles; there is no signal justifying emergency response.

A local user with a standard unprivileged account on a Pardus Linux system running an affected version of Pardus About launches the application and, due to absent authorization enforcement, accesses sensitive system or configuration data that should be visible only to privileged users. No network access, additional credentials, or interaction from a privileged user is needed. No public proof-of-concept has been identified at time of analysis.