CVE-2026-96283

Description

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

References

https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg

https://bugzilla.redhat.com/show_bug.cgi?id=2539424

https://access.redhat.com/security/cve/CVE-2026-96283

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS