CVE-2026-75037 in LACT
Summary
by MITRE • 08/25/2026
Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The Linux Advanced Configuration Tool, commonly known as LACT, is a graphical interface designed to simplify the management of systemd services and other system configurations on Linux distributions. A critical security flaw was identified in versions of LACT up through 0.10.0 regarding how it interacts with Polkit for privilege escalation requests. The vulnerability stems from an improper authentication mechanism where LACT relies on UnixProcessSubject or peer Process ID (PID) information to validate the identity of the requesting process when invoking administrative actions via Polkit. This approach assumes that the PID provided by the client is trustworthy and accurately represents the actual user context, which is a fundamental misconception in multi-user operating systems like Linux.
In standard POSIX-compliant environments, PIDs are not unique identifiers for long-term processes or users because they can be recycled rapidly after process termination. More critically, an attacker with local access to the system can exploit this trust relationship through race conditions or PID spoofing techniques. By carefully timing a request and potentially manipulating the environment in which LACT operates, a malicious actor can cause Polkit to associate the administrative action with a privileged context rather than the actual unprivileged user initiating the request. This flaw effectively allows an authentication bypass, enabling unauthorized users to execute commands that require root or high-level privileges without providing valid credentials.
The operational impact of this vulnerability is severe for any system running LACT where local access can be obtained by non-privileged accounts. An attacker could gain full control over the systemd service manager, potentially stopping critical security services such as firewalls or audit daemons, starting malicious backdoor services, or modifying configuration files that dictate system behavior. This level of compromise undermines the integrity and availability of the entire host machine. The vulnerability is categorized under CWE-287, which describes Improper Authentication, specifically highlighting issues related to identity verification using insufficiently unique identifiers like PIDs. In terms of offensive security frameworks, this aligns with MITRE ATT&CK technique T1068, Exploitation for Privilege Escalation, as it leverages a flaw in the authorization logic to elevate privileges from user level to root.
The issue was addressed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566, which likely refactors the authentication flow to use more robust identity verification methods supported by Polkit and systemd. These improvements typically involve using Unix user identifiers (UIDs) or session tokens that are tied to active login sessions rather than ephemeral process IDs. To mitigate this risk in environments where LACT is deployed, administrators should ensure they have upgraded to a version of LACT greater than 0.10.0 immediately upon availability. For systems unable to upgrade instantly, restricting physical and network access to the graphical desktop environment can reduce the attack surface, as local console or SSH-based attacks are required to exploit this specific PID spoofing vector. Additionally, auditing Polkit rules for custom configurations that might rely on similar weak identity checks is recommended to prevent analogous vulnerabilities in other administrative tools.