CVE-2026-96283 — Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible fo…
Published: 2026-09-27 · CVSS: 3.3 · CVSS 3.1
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7