{"id":"CVE-2026-87772","kind":"vulnerability","aliases":["CVE-2026-87772"],"related":[],"title":"Pardus About: incorrect authorization lets a user escalate privileges","description":"Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privilege Escalation.\n\nThis issue affects Pardus About: before 1.2.5.","summary":"Pardus About, the system information app of the Pardus Linux distribution made by TÜBİTAK BİLGEM, has an authorization flaw. A local user can gain higher privileges than they should have.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","linux","pardus","runtime"],"not_affected_if":["pardus-about-1.2.5-or-later"],"how_to_check":"- Check the installed Pardus About version (for example with the package manager, `dpkg -l | grep pardus-about` on Debian-based Pardus)\n- Compare the result against the fixed version below","fix":"- Pardus About: move to `1.2.5` or later","status":"open","published_at":"2026-11-12T07:16:47+00:00","first_seen_at":"2026-11-12T07:37:04+00:00","triaged_at":"2026-11-12T07:38:07+00:00","updated_at":"2026-11-12T07:38:07+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T07:38:07Z","model":"claude-haiku-5-5","output":{"fix":"- Pardus About: move to `1.2.5` or later","reach":"local","title":"Pardus About: incorrect authorization lets a user escalate privileges","impact":"high","summary":"Pardus About, the system information app of the Pardus Linux distribution made by TÜBİTAK BİLGEM, has an authorization flaw. A local user can gain higher privileges than they should have.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["pardus","linux","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"local user gains elevated privileges on the machine","analyst_note":"","how_to_check":"- Check the installed Pardus About version (for example with the package manager, `dpkg -l | grep pardus-about` on Debian-based Pardus)\n- Compare the result against the fixed version below","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["pardus-about-1.2.5-or-later"],"who_is_affected":"Systems running Pardus About before 1.2.5, typically Pardus desktop installations. The sources do not describe a remote trigger, so exposure is most likely to local users on those machines.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":4539,"output_tokens":452,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-87772':12A,15A '1.2.5':67C 'affect':63C 'allow':58C 'app':25B 'author':4A,37B,47C 'bilgem':34B,51C 'cve':10A,13A 'desktop':16B 'distribut':30B 'escal':8A,60C 'flaw':38B 'gain':43B 'higher':44B 'incorrect':3A,46C 'inform':24B 'institut':55C 'issu':62C 'let':5A 'linux':17B,29B 'local':40B 'made':31B 'pardus':1A,18B,20B,28B,56C,64C 'privileg':9A,45B,59C 'research':54C 'runtim':19B 'softwar':52C 'system':23B 'technolog':53C 'tübitak':33B,50C 'user':7A,41B 'vulner':48C","nicknames":[],"mitigations":[],"who_affected":"Systems running Pardus About before 1.2.5, typically Pardus desktop installations. The sources do not describe a remote trigger, so exposure is most likely to local users on those machines.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["desktop","high","linux","pardus","runtime"],"campaign_type":null,"search_a":"'-2026':11A,14A '-87772':12A,15A 'author':4A 'cve':10A,13A 'escal':8A 'incorrect':3A 'let':5A 'pardus':1A 'privileg':9A 'user':7A","search_b":"'app':25B 'author':37B 'bilgem':34B 'desktop':16B 'distribut':30B 'flaw':38B 'gain':43B 'higher':44B 'inform':24B 'linux':17B,29B 'local':40B 'made':31B 'pardus':18B,20B,28B 'privileg':45B 'runtim':19B 'system':23B 'tübitak':33B 'user':41B","search_c":"'1.2.5':67C 'affect':63C 'allow':58C 'author':47C 'bilgem':51C 'escal':60C 'incorrect':46C 'institut':55C 'issu':62C 'pardus':56C,64C 'privileg':59C 'research':54C 'softwar':52C 'technolog':53C 'tübitak':50C 'vulner':48C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T07:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87772","severity":null,"published_at":"2026-11-12T07:16:47+00:00","modified_at":"2026-11-12T07:16:47+00:00","first_seen_at":"2026-11-12T07:37:04+00:00","fetched_at":"2026-11-12T07:37:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}