NetworkManager failed to apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path properties, allowing an unprivileged local user to bypass server certificate validation in WPA-Enterprise connections. This vulnerability enables credential theft via a rogue access point by pointing the CA path to an attacker-controlled directory. It is an incomplete fix of a previous vulnerability (CVE-2025-9615).