Flatpak writes the OCI repository authentication token with insecure world-readable permissions (0644) in the system-helper's cache directory on Red Hat Enterprise Linux 10. This misconfiguration permits local users on a multi-user system to access the token and impersonate the authenticated user against the OCI repository. The vulnerability affects only OCI-based sources (e.g., Fedora) and does not impact libostree-based sources such as Flathub. The CVSS v3.1 score assigned by Red Hat is 3.2 (low severity) with an attack vector of local, low complexity, requiring low privileges and user interaction, and confidentiality impact limited to partial information disclosure. The vulnerability is tracked as CWE-378 (Creation of Temporary File With Insecure Permissions).

The vulnerability allows local users on a multi-user system to read an authentication token that should be protected, enabling them to impersonate the authenticated user against the OCI repository. This results in a confidentiality breach limited to the token's exposure. There is no impact on integrity or availability. The attack requires local access and user interaction.

Red Hat recommends using libostree repositories such as Flathub or unauthenticated (public) OCI repositories to avoid this issue. There is no explicit mention of an official patch or fix in the vendor advisory, so patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance. Users should avoid using OCI-based sources that write tokens with insecure permissions until a fix is available.