PT-2026-44372

CVE-2026-41045

Published

2026-05-28

Updated

2026-10-04

Description by

CVSS 3.1

8.1

High

MetricsAV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions qSnapper versions prior to 1.3.3

Description A time-to-check-time-of-use (TOCTOU) issue in the polkit authentication of qSnapper allows a local attacker to bypass the authentication mechanism. This can enable the attacker to perform operations with elevated privileges, such as acting as the root user. The software serves as a GUI frontend for the Snapper utility used for managing Btrfs snapshots.

Recommendations Update to version 1.3.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Matthias Gerstner

Vendors

Affected products

Weakness enumeration

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Related identifiers