CVE-2026-19816: fedora Incorrect Authorization
Vulnerability summary
CVE-2026-19816 is a high (CVSS 7.1) Incorrect Authorization vulnerability in fedora. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 1% of scored vulnerabilities.
Timeline
- 14-09-2026PublishedVulnerability first disclosed.
- 15-09-2026Last modifiedVulnerability information updated.
Description
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
0.10%
Chance of exploitation in the next 30 days
Percentile
1%
Versus all other CVEs
30-day change
-0.04 pp
From 0.14% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- packagekitAll versions (No fix recorded) | < 1.4.0-1
Fedora1 product
- fedora≥ 1.3.4, < 1.4.0
Opensuse1 product
- PackageKit&distro=openSUSE Tumbleweed< 1.4.0-1.1
Ubuntu1 product
- packagekitAll versions (No fix recorded)
4 vendors · 4 products
