CUPS CVE-2026-87876

Exploitation requires all of the following: the attacker must be on the same network segment as the CUPS server (AV:A - not exploitable over the internet); the attacker must hold a valid low-privilege CUPS user account (PR:L); user interaction is required per the CVSS UI:R metric, likely meaning a legitimate user must have an active session or print job in progress; and the target CUPS deployment must be configured with username-based printer ACLs or private-attribute restrictions - the bypass is a no-op in deployments that do not use these features. Exploitation is limited to confidentiality only (C:L): an attacker cannot modify jobs, alter printer configuration, or cause denial of service through this vector.

The overall risk profile is low. CVSS 3.0 with AV:A constrains exploitation to attackers already on the same network segment as the CUPS server, ruling out internet-scale opportunistic attacks; even a mid-sized municipal IT team in sopot would face this threat only from internal or lateral-movement actors, not remote internet threats. PR:L confirms an authenticated session is required, and UI:R adds a further dependency on victim-side interaction. The sole impact is C:L - limited information disclosure of private print attributes - with no integrity or availability consequence. No KEV listing, no POC, and no EPSS data were provided, suggesting this is not under active exploitation. The real-world risk is further bounded by the configuration dependency: ACL bypass is only meaningful where printer ACLs or private-attribute restrictions are actually configured, which many CUPS deployments do not use in a security-relevant way. Environments that rely on CUPS username-based ACLs to enforce confidentiality of sensitive print jobs (legal, healthcare) face slightly higher practical risk than default installations.

An attacker with a low-privilege CUPS account on the same network segment crafts a print request in which their username is submitted with altered casing (e.g., 'Admin' instead of 'admin') to a printer whose ACL is configured to restrict that user. The case-insensitive comparison in the secondary ACL validation path fails to reject the request, granting read access to private print job attributes - such as document names or job metadata - that should be filtered for that identity. No public exploit code has been identified at time of analysis.