CVE-2026-19816

Name of the Vulnerable Software and Affected Versions PackageKit (affected versions not specified)

Description An authorization flaw exists in PackageKit when using the dnf5 backend. The system skips the polkit authorization check for transactions that include the SIMULATE (dry-run) flag. However, the RepoRemove() function ignores this flag and executes the actual transaction due to a logic error in its guard condition (role == REPO REMOVE || !SIMULATE), which always evaluates to true for repository removal. This allows an unprivileged local user to perform an actual package uninstallation by falsely claiming to simulate the action, impacting the integrity and availability of the protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.