CVE-2026-87876: Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)
The OpenPrinting CUPS project contains two instances of case-insensitive username comparisons in authorization-adjacent code paths that were not addressed by the original CVE-2026-27447 fix. These exist in the printer ACL validation logic and private-attribute filtering mechanisms:
1. scheduler/ipp.c:checkquotas() - uses cupsstrcasecmp() for printer ACL username matching 2. scheduler/policy.c:cupsdGetPrivateAttrs() - uses cupsstrcasecmp() for @OWNER and explicit username checks
These patterns were removed from the primary authorization path in the original CVE-2026-27447 fix but persist in these secondary paths.
Affected versions: < 2.4.20. No patched release listed at time of advisory (fixes committed but not yet released).
Reference: https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2
Other sources
Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch GHSA-r8jp-q6fh-g5r2 - Compensating control
For OpenPrinting CUPS instances with versions < 2.4.20, mitigate the risk of bypass of username-based access controls by ensuring that the CUPS scheduler/authorization-adjacent code paths are not reachable or usable by untrusted users in the impacted configurations (specifically the scheduler/ipp.c:check_quotas() printer ACL username matching and scheduler/policy.c:cupsdGetPrivateAttrs() @OWNER/private-attribute filtering behavior).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OpenPrinting CUPS versions earlier than 2.4.20 are affected. Exploitation is relevant where printer ACLs or private-attribute access controls rely on exact username matching.
What does an attacker need to exploit the issue?
The attacker needs a low-privileged account and user interaction, according to the supplied vector. The issue involves request-derived usernames whose case differs from a username used in printer ACL or private-attribute checks.
Which controls can be bypassed?
The remaining case-insensitive comparisons occur in printer ACL validation in check_quotas() and private-attribute filtering in cupsdGetPrivateAttrs(), including @OWNER and explicit username checks. The main authorization path was addressed by the earlier CVE-2026-27447 fix, but these scheduler side paths remain affected.
What can be done before a patched release is available?
No patched release is listed in the advisory, although fixes have been committed. As a temporary mitigation, avoid relying on case-sensitive username distinctions in printer ACLs or private-attribute policies, and review configurations that grant different access based solely on username case.