CVE-2026-87876CWE-178

CVE-2026-87876

Low · published September 9, 2026

CVSS v3.1
3.0
EPSS
0%
Percentile
24.6
In the wild
Unconfirmed
What it is

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

The record
Technical detail
CVSS v3.1
3.0 · LOW
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00328 · 24.6th percentile
Weakness
CWE-178 · Improper Handling of Case Sensitivity
Published
2026-09-09T21:17Z
References (7)
https://access.redhat.com/errata/RHSA-2026:67568 · [email protected]https://access.redhat.com/security/cve/CVE-2026-87876 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2530991 · [email protected]https://github.com/OpenPrinting/cups/commit/88e67c00c130a45f3a1edf36686f7a0b2982fef8 · [email protected]https://github.com/OpenPrinting/cups/commit/f56844dbe4a54a9f8e1aeb3b913fbee614156bdb · [email protected]https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2 · [email protected]https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 16:12Z
    Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)
    cvelistv5