Search: CVE-2026-96281

CVE-2026-96281 is an improper access control vulnerability in Red Hat Enterprise Linux 10 affecting system-wide Flatpak applications. A local user with an active login session can downgrade a Flatpak app to an older version by removing the app's remote reference using an unprivileged system-helper method. This bypasses the anti-downgrade check, potentially exposing other users to vulnerable app versions with unfixed security issues. The vulnerability requires specific conditions and user interaction to exploit. Red Hat recommends ensuring Flatpak apps are fully updated before execution.