CVE-2026-96281
CVE-2026-96281: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.2
Medium [CVE-2026-96281] Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes
CVE-2026-96281Source published Source updated
On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities. Red Hat estimates the CVSSv3.1 vector from the provided vector CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Specific conditions must exist for the attack to occur and user interaction is required. Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-284. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat…
- Affected products in this advisory
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
1 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Ensure that Flatpak apps installed system-wide are fully updated before running them.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.