CVE-2025-66005CWE-863

Lack of Authentication in the InputManager D-Bus interface

High · published January 14, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
9.8
In the wild
Unconfirmed
What it is

Lack of authorization of the InputManager D-Bus interface in

InputPlumber versions before v0.63.0 can lead to local Denial-of-Service,

information leak or even privilege escalation in the context of the

currently active user session.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00203 · 9.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-01-14T11:53Z
EPSS history
Timeline
  • 14 JAN 11:53Z
    Lack of Authentication in the InputManager D-Bus interface
    cvelistv5