CVE-2026-41049CWE-863

Caching of Authentication allows Authentication Bypass between users in qSnapper

High · published June 22, 2026

CVSS v4.0
8.4
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

Incorrect caching of authentication between different users of the  qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions after a privileged users has authenticated for them.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00183 · 7.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-06-22T15:32Z
EPSS history
Timeline
  • 22 JUN 15:32Z
    Caching of Authentication allows Authentication Bypass between users in qSnapper
    cvelistv5