gnappper QSnapper Auth Bypass & Local Privilege Escalation via m_authenticated Flag

Vulnerability Overview CVE ID: CVE-2026-41048, CVE-2026-41049 Vulnerability Name: gnappper: authentication bypass across clients via shared "m_authenticated" flag Status: RESOLVED FIXED Product: openSUSE Tumbleweed Component: Security (show other bugs) Version: Current Hardware: Other Other Priority: P5 - None Severity: Normal (vuln) Target Milestone: --- Assignee: Matthias Gerstner QA Contact: E-mail List URL: --- Whiteboard: --- Keywords: --- Depends On: --- Blocks: 1066557, 10664330 Impact Description: - Recent code changes introduced an "m_authenticated" flag in the D-Bus daemon, which caches the authentication status of the caller after a successful invocation. - This caching occurs in the , , and methods. - Several issues exist with this implementation: - authenticates the "delete-snapshot" operation, while the other methods authenticate the "rollback-snapshot" operation. If a caller authenticates for "delete-snapshot," they are automatically authenticated for "rollback-snapshot," and vice versa. - This is not the intended usage of Polkit. If a system administrator decides to relax the authentication requirements for "delete-snapshot," it automatically relaxes the requirements for "rollback-snapshot" as well, which have distinctly different impacts on the system. - The implementation of this feature assumes that only a single interactive client is communicating with the daemon. In reality, any user can invoke these methods. If a legitimate client authenticates within the daemon, other users (such as "nobody") are now also considered authenticated, and Polkit is no longer invoked. - This authentication state allows for a full local root privilege escalation via the method (see below). Scoring: - CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (+7.1) - CVSS 4.0: AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:H/AV:N/SA:N (+8.0) - Issues: - The attacker does not require special privileges but requires user interaction. - The attacker requires some privileges to authenticate for an operation, but no user interaction is needed. - The impact is primarily on availability and integrity, potentially leading to data loss and system state corruption. - CWE-683: Incorrect Authorization - CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (+7.1) - CVSS 4.0: AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/SC:H/AV:N/SA:N (+6.9) - Issues: - The attacker requires some privileges to authenticate for an operation, but no user interaction is needed. - The impact is primarily on availability and integrity. - A typical scenario involves a local user being granted permission to delete snapshots, but gaining the ability to roll back the system state as well. - CWE-683: Incorrect Authorization Remediation Fix Status: RESOLVED FIXED Fix Link: https://github.com/parsix/qSnapper/releases/tag/v1.3.3 POC Code or Exploit Code No specific POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

gnappper QSnapper Auth Bypass & Local Privilege Escalation via m_authenticated Flag