Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service). Tampered content will fail signature/digest verification rather than being trusted. The vulnerability has a CVSS 3.1 score of 3.9 (low severity) with attack vector local, low attack complexity, low privileges required, and user interaction required. Red Hat recommends setting a restrictive umask (e.g., 022) to mitigate the issue. No official patch or fix is indicated in the advisory; mitigation is configuration-based.

The vulnerability allows local users on multi-user systems with permissive umask settings to read or modify temporary directories used by Flatpak during installation processes. This can lead to denial of service by causing installation failures. There is a low confidentiality impact as some information in the temporary files could be read, but integrity is not compromised because tampered content fails verification. No known exploits are reported in the wild.

Red Hat advises setting a umask that prevents other users from writing to the cache directory, for example, using 'umask 022'. More restrictive umasks (e.g., 027 or 077) may cause the flatpak-system-helper to fallback to less efficient copying methods with warnings. No official patch is currently available; patch status is not yet confirmed—check the Red Hat advisory for updates.