OpenPrinting CUPS (Common UNIX Printing System) versions up to 2.4.16 contain an improper authentication vulnerability (CWE-287) where a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service using a reusable Authorization: Local token. This token grants the ability to perform /admin/ requests locally. By combining the CUPS-Create-Local-Printer request with the printer-is-shared=true setting, the attacker can create a printer queue with a file:/// URI, bypassing the FileDevice policy that normally rejects such URIs. Printing to this queue allows arbitrary root file overwrite, demonstrated by dropping a sudoers fragment to achieve root command execution. There are no known public patches or vendor advisories providing fixes at the time of publication.

This vulnerability allows a local unprivileged user to escalate privileges to root by exploiting improper authentication and file overwrite capabilities in CUPS. The attacker can overwrite arbitrary root-owned files, potentially leading to full system compromise. The CVSS 4.0 base score is 5.0 (medium severity), reflecting the requirement for local access and some complexity in exploitation but significant impact if exploited.

At the time of publication, no official patches or fixes are available for this vulnerability. Users should monitor the OpenPrinting project and vendor advisories for updates. Until a patch is released, restricting local user access to the CUPS service and limiting untrusted local user accounts may reduce risk. Avoid running untrusted code locally and consider disabling or restricting CUPS administration interfaces where possible.