https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-02T10:14:44.317029+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-7867 CVE-2026-7867 — Udisks2: udisks2: local privilege escalation via as-user option spoofing 2026-10-02T10:14:44.347582+00:00

Affected: udisks, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

 https://db.gcve.eu/vuln/usn-8701-1 USN-8701-1 — udisks2 vulnerability 2026-10-02T10:14:44.347682+00:00

Affected: Ubuntu:24.04:LTS: udisks2, Ubuntu:26.04:LTS: udisks2

It was discovered that UDisks did not correctly validate the caller identity when handling the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. A local attacker with an active console session could possibly use this issue to mount filesystems on behalf of arbitrary users, including privileged accounts, leading to local privilege escalation.