CVE-2026-96424: Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

Published Oct 16, 2026

Updated

Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus

Affected Software

1 affected component

Lomiri lomiri-download-manager

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade lomiri-download-manager to a version that resolves this vulnerability.
Fixed in 0.3.3
Upgrade
Upgrade Ubuntu Touch to a version that resolves this vulnerability.
Fixed in 24.04-2.1
Upgrade
Upgrade Ubuntu Touch to a version that resolves this vulnerability.
Fixed in 24.04-1.5

Event History

Oct 16, 2026

CVE Published

via MITRE·03:35 PM

Data Sourced

via MITRE·03:35 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any local user can exploit the incorrect DBus policy. The published vector requires local access and low privileges; no user interaction is required.

What access does exploitation provide?

An attacker can use DBus to cause lomiri-upload-manager to read arbitrary files as root. This can expose files that the attacking user would not normally be permitted to read.

How can I determine whether my installation is affected?

Check whether lomiri-download-manager includes the DBus policy correction from commit 779dfd5bbeb5fe8877627b772e5024e40eda38aa. The provided data does not identify affected or fixed release versions.