Vulnerability · Published Jun 22, 2026 · Assigned by suse

CVE-2026-41049Caching of Authentication allows Authentication Bypass between users in qSnapper

High 8.4

In plain English

A high-severity incorrect authorization in qSnapper from presire. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)0.2%top 92.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions after a privileged users has authenticated for them.

Affected products (as reported)

Vendor	Product	Versions
presire	qSnapper	1.2.1 – before 1.3.3

Weakness: CWE-863 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html#issue-auth-caching third-party-advisory
https://github.com/presire/qSnapper/releases/tag/v1.3.3 vendor-advisory
https://bugzilla.suse.com/show_bug.cgi?id=1262218 issue-tracking