CVE-2026-111253 Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction

A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and replace its resolved transaction plan. I...

CVE-2026-111253 Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction

A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and replace its resolved transaction plan. I...

CVE-2026-111253

A vulnerability exists in dnf5daemon-server (part of the dnf5 package) where session methods on dynamically exported D-Bus session objects lack a session-owner check. This flaw allows a local attacker to intercept and modify another user's live package-management session by replacing its resolved...