CVE-2026-104619

EUVD-2026-120864
Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
suseCNA
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 2.3%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
packagekit_projectpackagekit
𝑥
< 1.4.1
CNA
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
PackageKit
suse enterprise desktop 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP7
1.2.8-150600.4.20.1
fixed
PackageKit-backend-zypp
suse enterprise desktop 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP7
1.2.8-150600.4.20.1
fixed
PackageKit-devel
suse enterprise desktop 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP7
1.2.8-150600.4.20.1
fixed
PackageKit-gstreamer-plugin
suse enterprise desktop 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise workstation 15 SP7
1.2.8-150600.4.20.1
fixed
PackageKit-gtk3-module
suse enterprise desktop 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise workstation 15 SP7
1.2.8-150600.4.20.1
fixed
PackageKit-lang
suse enterprise desktop 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP7
1.2.8-150600.4.20.1
fixed
libpackagekit-glib2-18
suse enterprise desktop 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP7
1.2.8-150600.4.20.1
fixed
libpackagekit-glib2-devel
suse enterprise desktop 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP7
1.2.8-150600.4.20.1
fixed
typelib-1_0-PackageKitGlib-1_0
suse enterprise desktop 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise sap 15 SP7
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP6
1.2.8-150600.4.20.1
fixed
suse enterprise server 15 SP7
1.2.8-150600.4.20.1
fixed
Common Weakness Enumeration
References
https://bugzilla.suse.com/show_bug.cgi?id=1284389