{"schema":"threatline.record/2","record":{"id":"CVE-2026-96283","aliases":["GHSA-89xm-3m96-w3jg"],"summary":"Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull","details":"By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.","categories":["Operating systems"],"product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96283","source_modified_at":"2026-09-28T13:34:26.766Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[],"defaultStatus":"affected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96283","source_modified_at":"2026-09-28T13:34:26.766Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat","versions":[],"defaultStatus":"affected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96283","source_modified_at":"2026-09-28T13:34:26.766Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[],"defaultStatus":"affected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96283","source_modified_at":"2026-09-28T13:34:26.766Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[],"defaultStatus":"affected"}],"fixed_versions":[],"cvss":3.3,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00149,"percentile":0.03793,"score_date":"2026-10-23"},"published_at":"2026-09-27T21:53:40.259Z","modified_at":"2026-09-28T13:34:26.766Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-96283","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-28T13:34:26.766Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96283","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2026-96283","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539424","tags":["issue-tracking","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-28T13:32:31.877226Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-28T13:34:26.766Z","content_hash":"a5754de4887aa28a2c2ca6d5bfcd758dc3f52a9e7f47e93e119687fdba70b840"}}