Missing Authorization Vulnerability in Policycoreutils by SUSE
CVE-2026-59677

6.8MEDIUM

Key Information:

Vendor

Selinuxproject

Status
Selinux
Vendor
CVE Published:
23 July 2026

What is CVE-2026-59677?

A Missing Authorization vulnerability in the SELinux policycoreutils module affects users operating within an unconfined context. This flaw enables such users to terminate processes that are owned by the root user and also running in an unconfined environment. The vulnerability primarily impacts policycoreutils version 3.10, posing significant security risks by allowing unauthorized access to critical system processes.

Affected Version(s)

selinux 0 <= 3.10

References

https://bugzilla.suse.com/show_bug.cgi?id=1268256
https://security.opensuse.org/2026/07/15/selinux-seunshar...

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthias Gerstner of SUSE
.