Pardus Parental Control EUVD-2026-88969

Requires an interactive local session as any unprivileged user on a host running Pardus Parental Control before 0.7.0 with the default (vulnerable) polkit policy tr.org.pardus.pkexec.parental-control.policy, whose allow_any/allow_inactive/allow_active are all set to 'yes'. The concrete trigger is invoking PPCActivator.py with the --disable argument via pkexec, which then runs as root with no admin authentication. Limiting factors: no remote vector (physical or existing local access needed), the product must be installed and enforcing controls, and only pre-0.7.0 policy files are affected - patched systems require auth_admin and prompt for credentials.

This is a genuine but sharply bounded local privilege/authorization flaw, not a high-severity remote issue. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N, 6.8) is internally consistent with the description and the source-code evidence: the polkit action tr.org.pardus.pkexec.parental-control.policy shipped with allow_any/allow_inactive/allow_active all set to 'yes', so any already-logged-in local user can invoke PPCActivator.py --disable through pkexec as root with no admin authentication prompt. Attack vector is strictly LOCAL (AV:L) and requires an existing low-privilege session (PR:L), which caps real-world risk. There is no EPSS score, no CISA KEV listing, and no public POC in the provided intelligence - so exploitation status is 'no public exploit identified at time of analysis.' The impact is integrity-only (VI:H / I:H): the attacker doesn't read data or crash the host, they defeat the parental-control policy itself (DNS filtering, application limits). The signals are not conflicting - CVSS vector, CWE-863 (incorrect authorization), and the diff all agree. The main caveat is that the confidentiality framing is N: this is a control-evasion bug, so severity should be read as 'child/restricted user escapes supervision,' which is exactly the abuse case for this product rather than a classic server compromise.

A restricted local user (e.g., the child account the software is meant to constrain) opens a terminal and runs pkexec python3 PPCActivator.py --disable; because the polkit policy grants allow_active=yes, pkexec executes the disable action as root with no password or admin prompt, removing all DNS filtering and application time limits. No public exploit code is required - the attack is a single documented command against the default policy. No POC is referenced in the provided intelligence.