Access Control Bypass Vulnerability in CUPS by OpenPrinting
CVE-2026-87876

3LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
9 September 2026

What is CVE-2026-87876?

A vulnerability in CUPS's scheduler allows for the potential bypass of access controls based on case-insensitive comparisons of request-derived usernames. This issue specifically affects the ACL (Access Control List) validation and private attribute filtering when certain configurations are employed. If exploited, unauthorized users may gain inappropriate access to resources, highlighting the need for immediate patching and configurations adjustments in affected environments.

References

https://access.redhat.com/security/cve/CVE-2026-87876
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2530991
issue-trackingx_refsource_REDHAT
https://github.com/OpenPrinting/cups/security/advisories/...

CVSS V3.1

Score:
3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank arbor-s (Independent Security Researcher) for reporting this issue.
.