CVE-2026-7867

Name of the Vulnerable Software and Affected Versions udisks2 (affected versions not specified)

Description Insufficient authorization checking in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method allows a local attacker with an active console session to spoof the as-user parameter. This enables the attacker to mount filesystems on behalf of arbitrary users, including privileged accounts, potentially leading to local privilege escalation via mount point injection and manipulation of the mount namespace visible to privileged users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.