CVE-2026-96281: Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes
GHSA-q4gr-vc25-57m5 (https://github.com/flatpak/flatpak/security/advisories/GHSA-q4gr-vc25-57m5)
Description: By using the system helper's unprivileged RemoveLocalRef method, an attacker was able to remove the remote ref of the app or runtime. The anti-downgrade check would fail to find the remote ref, and with it the date to check against, allowing an attacker to bypass the check and downgrade apps.
Mitigation: Ensure that Flatpak apps installed system-wide are fully updated before running them. Fixed in 1.18.1 (backports available for 1.16.x). Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2. Contributing Researcher: Vivek Parikh.
Other sources
On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flatpakto a version that resolves this vulnerability.Fixed in 1.18.1 - Compensating control
Ensure that Flatpak apps installed system-wide are fully updated before running them.
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Multi-user systems with system-wide Flatpak apps or runtimes are exposed when an unprivileged user has an active local login session. The impact can extend to other users because the downgraded application is installed system-wide.
What does an attacker need to exploit this?
The attacker needs to be a local unprivileged user with an active login session on the system. They exploit the unprivileged system-helper RemoveLocalRef method to remove the app's remote reference before downgrading it.
What is the security impact of a successful downgrade?
A successful downgrade can install an older app version whose vulnerabilities have not been fixed. Other users of the same system may then use that vulnerable system-wide version.