CVE-2026-41048 describes a vulnerability in presire's qSnapper product where improper caching of authentication states between polkit methods leads to privilege escalation. Local attackers with limited permissions can exploit this flaw to invoke higher-privileged functions, such as restoring snapshots, despite only having rights to delete snapshots. The issue affects versions 1.2.1 and all versions from 1.2.1 up to but not including 1.3.3. No official remediation level or patch information is provided in the available data.

The vulnerability allows a local attacker with limited privileges to bypass intended authorization checks and perform unauthorized actions, potentially leading to unauthorized system modifications via snapshot restoration. This elevates the attacker's capabilities beyond their assigned permissions, posing a significant security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor presire's advisories for updates and consider restricting local access to trusted users only until a fix is available.