Description
An Incorrect Authorization vulnerability (CWE-863) combined with insecure mount options in Pardus About allows an unprivileged local desktop user to achieve local privilege escalation to root. The root helper mounted discovered partitions without nosuid, nodev, or noexec semantics while the polkit policy authorized active sessions without a password challenge. Upstream addressed the execution primitive in 1.2.5 by enforcing ro,nosuid,nodev,noexec mount flags.
CVSS Vector
Primary assessmentTR-CERT CNA · 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAV: LocalAC: LowPR: LowUI: NoneS: UnchangedC: HighI: HighA: High
Disclosure Status
- Affected
- < 1.2.5 (verified against debian/1.2.4)
- Patch status
- Fixed in debian/1.2.5
- Vendor response
- Upstream mount hardening merged in commit b439777
- Primary score source
- TR-CERT CNA
References
- CVE.org Record
- SSB / USOM Advisory TR-26-1521
- pardus-about Upstream Patch (b439777)
- pardus-about Debian 1.2.5 Release Tag
- NVD — National Vulnerability Database
- MITRE CVE Entry
Record Verification
CreditThe official CVE record credits Sevban DÖNMEZ as finder
PublishedThe CVE record was published on 2026-11-12
CheckedMetadata last checked against the CVE Services record on 2026-11-12
Disclosure Timeline
2026-08-22Reproduction — Vulnerable behavior reproduced against pardus-about 1.2.4 in an isolated Pardus 25.2 lab.
2026-08-25Evidence package — Deterministic evidence package and negative controls completed.
2026-09-10Upstream patch — Upstream mount-hardening change and debian/1.2.5 release tag published. Source ↗
2026-09-16Casefile complete — Technical casefile and root-cause analysis completed.
2026-11-12Published — TR-CERT published the CVE-2026-87772 record on CVE.org, and the SSB / USOM advisory TR-26-1521 recommended upgrading to pardus-about 1.2.5 or later. Source ↗
2026-11-12Site verification — jankesec confirmed the published CVE.org record, the TR-CERT CVSS, the affected versions and the SSB advisory reference.