CVE-2026-96283 in Flatpak
Summary
by MITRE • 09/28/2026
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified in Flatpak involves a critical flaw within the SystemHelper service component, specifically regarding the handling of remote package installation operations known as pulls. The core issue stems from an improper authorization check when invoking the CancelPull method on behalf of another user. In a properly secured system, administrative privileges or specific policy rules should strictly govern who can terminate processes belonging to other users to prevent privilege escalation and denial-of-service attacks. However, in this instance, the SystemHelper allows any authenticated local session to request the cancellation of a pull operation initiated by a different user account without verifying that the requesting entity has sufficient authority over that target process or transaction.
From a technical perspective, the flaw lies in the logic governing state management for ongoing transactions. When CancelPull is called with insufficient privileges, instead of rejecting the request and returning an access denied error, the system proceeds to remove the pull operation from its internal tracking structures. This action effectively dissociates the running process from the user interface or monitoring tools that rely on this metadata. Consequently, while the underlying download or installation process continues to execute in the background, it becomes invisible to standard management interfaces. The owning user loses the ability to interact with, monitor, or terminate their own operation because the system no longer recognizes its existence within the active transaction list.
The operational impact of this vulnerability is significant for both end-users and system administrators. For regular users, it results in a denial-of-service condition where they cannot stop resource-intensive operations that may be consuming bandwidth, CPU cycles, or disk I/O unnecessarily. This can lead to performance degradation on shared systems or unintended data usage if the pull continues indefinitely. Furthermore, this behavior undermines user trust in the system's reliability and control mechanisms. For administrators, it presents a potential vector for disrupting service availability by forcing users into unmanageable states that require manual intervention at the process level rather than through standard API calls.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as the system fails to enforce proper authorization policies when managing cross-user operations. It also relates to CWE-755, Improper Handling of Unexpected or Unusual Input State, because the application enters an inconsistent state where a running process exists without corresponding tracking metadata. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior can be categorized under T1499 Endpoint Denial of Service, specifically via resource exhaustion or service disruption techniques that leverage legitimate administrative tools to degrade system functionality for specific users.
Mitigation strategies should focus on tightening the access control policies within Flatpak's D-Bus configuration and SystemHelper implementation. Developers must ensure that any method capable of terminating operations belonging to other users requires explicit elevated privileges, such as root access or membership in a designated admin group. Additionally implementing strict validation checks before modifying internal state structures is essential to prevent orphaned processes. Until patched, system administrators can mitigate the risk by restricting D-Bus access to SystemHelper methods for non-root users through polkit rules or systemd service restrictions, thereby preventing unauthorized cancellation requests from being processed at all.