CVE-2026-96283

3.3 LOWpublic exploit available

Published 2026-09-27 · Updated 2026-09-29

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weaknesses

CWE-862

Public exploit & PoC references

https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg

All references

https://access.redhat.com/security/cve/CVE-2026-96283
https://bugzilla.redhat.com/show_bug.cgi?id=2539424
https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-14484
MEDIUMCVE-2025-14486
MEDIUMCVE-2025-14487
UNSCOREDCVE-2026-100240
MEDIUMCVE-2026-100287
MEDIUMCVE-2026-100289
MEDIUMCVE-2026-100303PoC
MEDIUMCVE-2026-100305PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.