EUVD-2026-38272
GHSA-x7qh-xcf8-p6cq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local user shell on qSnapper host
-
DeliveryConnect to system D-Bus
-
ExploitWait for admin to authenticate any qSnapper action
-
ExecutionInvoke privileged method reusing shared m_authenticated
-
ImpactRead or alter Btrfs snapshots and configs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication algorithm review
|
| Exploitation Conditions | Requires a local session on the same system bus as the qSnapper privileged D-Bus service and a separate, recently-authenticated admin client on that bus whose cached m_authenticated state can be inherited; the attacker themselves does not need to pass Polkit. Exploitation is limited to hosts where qSnapper's system service is installed and active (primarily SUSE/openSUSE desktops), and is not reachable over the network or from sandboxed contexts that lack access to the system D-Bus. |
| Impact | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, base 8.4) is consistent with the description: a local user with an active session on the system bus can abuse the shared auth flag without user interaction, gaining high confidentiality and integrity impact over snapshot data and configuration, with no direct availability impact. EPSS and CISA KEV data were not provided for this CVE; given local-only reach and that the affected component is a niche desktop utility, real-world exploitation is likely opportunistic rather than mass-scanned, even though the bug is trivial to trigger once another admin-authenticated client exists on the bus. The SSVC-style read is: exploitation status = none observed, automatable = yes within a multi-user host, technical impact = total over the snapshot service - making this a high priority on multi-user SUSE/openSUSE workstations where qSnapper is installed, and low priority on single-user systems with no other Polkit admin sessions. |
| Exploit ScenarioDerived | On a multi-user Linux host with qSnapper installed, a logged-in standard user waits for (or socially engineers) an administrator to run any qSnapper operation that triggers the Polkit admin prompt. As soon as the admin authenticates, the standard user's session calls the same privileged D-Bus methods (snapshot create/delete, restore, diff) and is silently granted access because the m_authenticated flag is process-global rather than per-caller. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Authentication bypass in qSnapper's privileged D-Bus service (versions before 1.3.3) allows any local unprivileged user to invoke administrative snapshot operations by piggy-backing on another client's prior Polkit authentication. The service stored authentication state in a single shared m_authenticated flag rather than per-client, so once any caller passed an admin check, all subsequent D-Bus callers inherited that state. No public exploit identified at time of analysis; the issue was found during a SUSE-coordinated security review and patched in v1.3.3.
RemediationAI
Upgrade to qSnapper 1.3.3 or later, which removes the shared m_authenticated cache and the Authenticate() D-Bus method and delegates re-authorization to Polkit's auth_admin_keep behavior (release notes: https://github.com/presire/qSnapper/releases/tag/v1.3.3). On SUSE/openSUSE, install the distribution update tracked in https://bugzilla.suse.com/show_bug.cgi?id=1262218 once it lands. If patching must be deferred, mitigate by stopping and masking the qSnapper system D-Bus service (systemctl mask) so the privileged endpoint is unreachable - accepting the trade-off that snapshot management from the GUI will be unavailable - or by tightening the Polkit policy for com.presire.qsnapper actions to auth_admin (forcing a fresh prompt every call) rather than any cached variant; this will produce noticeable extra auth prompts but blocks the cross-client carry-over.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
qSnapper is a Qt-based front-end and privileged D-Bus backend service for managing Btrfs snapshots (a Snapper-style utility). Its system bus service exposed methods gated by Polkit checks, but the implementation cached the outcome in a process-wide member variable (m_authenticated) plus a custom Authenticate() D-Bus method, instead of evaluating Polkit per-call and per-caller. This is a textbook CWE-303 (Incorrect Implementation of Authentication Algorithm): the auth decision is computed correctly once, then incorrectly reused across distinct security principals. The upstream fix removes the cache and the Authenticate() method entirely and relies on Polkit's native auth_admin_keep behaviour, which scopes recent authorizations to the specific bus name that requested them.
Know when Qsnapper gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Local D-Bus reach gives AV:L; any local user suffices so PR:L; no user interaction; high confidentiality and integrity over snapshots, no availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
Executive ViewAI
qSnapper vulnerability in versions before 1.3.3 enables unprivileged local users to execute administrative snapshot operations without proper authorization. No public exploit identified at time of analysis; however, the vulnerability is trivial to exploit once understood, creating substantial risk for any organization running affected versions. Immediate remediation through patching is critical given the potential for privilege escalation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Local privilege escalation in qSnapper D-Bus service before version 1.3.3 allows any unprivileged local user to invoke p
Local privilege escalation and denial of service in qSnapper before 1.3.3 stems from path traversal via the configName D
Local privilege escalation in presire qSnapper before 1.3.3 lets a low-privileged user bypass Polkit authentication in t
Unauthenticated local access to qSnapper's D-Bus snapshot diff interface before version 1.3.3 exposes read-protected fil
Exploit-DB