CVE-2026-96424

CVE-2026-96424 · Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus

CVSS 7.8 · High · EPSS 0.1% · Fix available

Stack: system

Affected products and versions

lomiri-download-manager
Versions
- ≥ 0.1.0, < 0.3.3: Affected (semver)
Update to 0.3.3
lomiri-download-manager Debian:12
Versions
- 0.1.2-1
- 0.1.2-2
- 0.1.2-2.1~exp1
- 0.1.3-1
- 0.1.3-2
- 0.1.3-2.1
- 0.1.3-3
- 0.1.3-4
- 0.1.3-5
- 0.2.0-1
- 0.2.1-1
- 0.2.1-2
- 0.2.1-3
- 0.2.2-1
- 0.3.1-1
- 0.3.1-1~bpo13+1
- 0.3.1-2
- 0.3.2-1
- 0.3.2-2
- 0.3.3-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lomiri-download-manager Debian:13
Versions
- 0.2.1-3
- 0.2.2-1
- 0.3.1-1
- 0.3.1-1~bpo13+1
- 0.3.1-2
- 0.3.2-1
- 0.3.2-2
- 0.3.3-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lomiri-download-manager Debian:14
Versions
- 0.2.1-3
- 0.2.2-1
- 0.3.1-1
- 0.3.1-1~bpo13+1
- 0.3.1-2
- 0.3.2-1
- 0.3.2-2
Affected ranges
- ECOSYSTEM: < 0.3.3-1
Update to 0.3.3-1
lomiri-download-manager Ubuntu:22.04:LTS
Versions
- 0.1.0-8
- 0.1.0-9
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lomiri-download-manager Ubuntu:24.04:LTS
Versions
- 0.1.2-1ubuntu1
- 0.1.2-2ubuntu1
- 0.1.2-2ubuntu2
- 0.1.3-4build1
- 0.1.3-4build2
- 0.1.3-4build3
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lomiri-download-manager Ubuntu:26.04:LTS
Versions
- 0.2.1-3build2
- 0.2.2-1
- 0.2.2-1build1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published