SUSE-SU-2026:4610-1 Security update for flatpak

This update for flatpak fixes the following issues: - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. - CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc128251...

DEBIAN-CVE-2026-107466

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration CI system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers URIs within source download definitions, t...

CVE-2026-107466

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration CI system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers URIs within source download definitions, t...

CVE-2026-107466

A flaw in flatpak-builder allows for information disclosure by bypassing directory confinement checks. An attacker can craft a build manifest containing local file Uniform Resource Identifiers (URIs) within source download definitions. When a user or a continuous integration (CI) system processes...

EUVD-2026-94800

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration CI system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers URIs within source download definitions, t...

CVE-2026-107466 Flatpak-builder: local file exfiltration via `file

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration CI system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers URIs within source download definitions, t...

CVE-2026-107466

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration CI system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers URIs within source download definitions, t...

CVE-2026-107445

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

EUVD-2026-94693

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

CVE-2026-107445 Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

CVE-2026-107445 Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

CVE-2026-107445

A flaw in Katello exists where the Flatpak Remote Repositories API fails to properly enforce authorization when accessing repositories by identifier. This allows an authenticated user with permissions in one organization to potentially access repository information belonging to a different organi...

CVE-2026-107445

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

PT-2026-107791

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

Linux Distros Unpatched Vulnerability : CVE-2026-107466

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration CI...

PT-2026-107864

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration CI system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers URIs within source download definitions, t...

UBUNTU-CVE-2026-107466

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration CI system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers URIs within source download definitions, t...

Astra Linux – Vulnerability in Flatpak

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak application could execute arbitrary code outside its sandbox. Normally, the --command argument of flatpak...

Astra Linux – Vulnerability in Flatpak

Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. The flatpak-builder command applies the finish-args option last in the build process. At this point, the build directory will have full acce...

Astra Linux – Vulnerability in Flatpak

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app that used persistent directories could access and write files outside of its usual access rights, which constituted an attack on integrity and...