CVE-2026-96283

Description

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

CVSS Vector

References

• https://access.redhat.com/security/cve/CVE-2026-96283
• https://bugzilla.redhat.com/show_bug.cgi?id=2539424
• https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg