Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull

Why this deserves its current priority

CVSS is 3.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Red Hat/flatpak (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Red Hat/flatpak.
2. 2Review the reported fix. Source-reported workaround: No known mitigation other than updating.

Evidence timeline and material changes

1. Published upstream

   Sep 27, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 27, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 27, 2026

Sources and claim methodology

• Source referenceaccess.redhat.com
• Source referencebugzilla.redhat.com
• GitHub security advisorygithub.com

Related CVEs

• Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinksSame red hat/flatpak package
• Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systemsSame red hat/flatpak package
• Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimesSame red hat/flatpak package
• Flatpak: flatpak: extension metadata path traversal file existence oracleSame red hat/flatpak package
• Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink followingSame red hat/flatpak package
• mathurvishal CloudClassroom-PHP-Project cross-site request forgeryAlso CWE-862