CVE-2026-75037: Polkit authentication bypass in LACT
Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.10.0Patch d0478fe42c2219454e272f96b1cbd29ab37ee566
Event History
Frequently Asked Questions
Which deployments are affected?
LACT versions through 0.10.0 are affected. The issue applies to LACT running on Linux.
What access does an attacker need to exploit this issue?
The listed vector requires local access, low privileges, and high attack complexity. No user interaction is required.
What is the impact if exploitation succeeds?
Successful exploitation can bypass Polkit authentication and has high potential impact on confidentiality, integrity, and availability.
What remediation is available?
Update to a version containing commit d0478fe42c2219454e272f96b1cbd29ab37ee566. The provided data does not identify a specific fixed release version.