{"id":"CVE-2026-96424","kind":"vulnerability","aliases":["CVE-2026-96424"],"related":[],"title":"Lomiri upload manager: DBus policy lets any user read root files","description":"Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus","summary":"The system-bus instance of lomiri-upload-manager runs as root, and its DBus policy lets any local user call it. An unconfined local app can make it read any root-readable file and POST the contents to a URL the attacker picks. AppArmor-confined Ubuntu Touch apps cannot reach it.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"lomiri-download-manager","fixed":["0.3.3"],"affected":">= 0.1.0, <= 0.3.2","ecosystem":"linux"},{"name":"ubuntu-touch","fixed":["24.04-1.5","24.04-2.1"],"affected":"<= 24.04-1.4, 24.04-2.0","ecosystem":"linux"}],"ecosystems":[],"tags":["dbus","infrastructure","linux","local-privilege","lomiri","lomiri-download-manager","ubuntu-touch","unconfined-apps"],"not_affected_if":["apparmor-confined-apps-only","patched-0.3.3"],"how_to_check":"Check the installed lomiri-download-manager version (for example dpkg -l lomiri-download-manager); 0.3.2 or older is affected. On Ubuntu Touch, a build older than 24.04-2.1 (or 24.04-1.5 on the 1.x line) is affected. Vendor does not give a test command.","fix":"Update lomiri-download-manager to 0.3.3 or newer (covers lomiri-upload-manager). On Ubuntu Touch, update to 24.04-2.1 or 24.04-1.5. The fix locks the system-bus DBus policy so arbitrary users cannot reach the service.","status":"open","published_at":"2026-10-16T16:22:52+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:10:16+00:00","updated_at":"2026-10-25T03:46:48+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-25T03:10:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Lomiri upload manager: DBus policy lets any user read root files","impact":"high","summary":"The lomiri-upload-manager service, part of lomiri-download-manager, has an incorrect DBus policy. Any local user can ask it over DBus to read arbitrary files as root.","category":"infrastructure","nicknames":[],"who_cares":["linux","lomiri","ubuntu-touch"],"confidence":0.6,"needs_auth":"no","worst_case":"Any local user reads arbitrary root-owned files over DBus","analyst_note":"Check the NVD entry and upstream Lomiri advisory for affected versions, the fixed release and whether default installs ship the policy.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000493,"input_tokens":3280,"output_tokens":330,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and upstream Lomiri advisory for affected versions, the fixed release and whether default installs ship the policy.","search":"'-2026':13A,16A '-96424':14A,17A 'allow':110C 'app':41B,68B,93B 'apparmor':89B 'apparmor-confin':88B 'arbitrari':111C,115C 'attack':86B 'bus':45B 'call':63B 'cannot':94B 'confin':90B 'content':81B 'cve':12A,15A 'dbus':4A,25B,57B,97C,120C 'download':20A,34B,108C 'file':11A,77B,116C 'incorrect':96C 'infrastructur':26B 'instanc':46B 'let':6A,59B 'linux':27B 'local':29B,61B,67B 'local-privileg':28B 'lomiri':1A,19A,31B,33B,49B,101C,107C 'lomiri-download-manag':32B,106C 'lomiri-download-manager':18A 'lomiri-upload-manag':48B,100C 'make':70B 'manag':3A,35B,51B,103C,109C 'manager':21A 'part':104C 'pick':87B 'polici':5A,58B,98C 'post':79B 'privileg':30B 'reach':95B 'read':9A,72B,114C 'readabl':76B 'root':10A,54B,75B,118C 'root-read':74B 'run':52B 'system':44B 'system-bus':43B 'touch':24A,38B,92B 'ubuntu':23A,37B,91B 'ubuntu-touch':22A,36B 'unconfin':40B,66B 'unconfined-app':39B 'upload':2A,50B,102C 'url':84B 'user':8A,62B,112C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{"fix":{"at":"2026-10-25T03:46:48Z","by":"analyst","run_id":792}},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:22:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96424","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96424","severity":null,"published_at":"2026-10-16T16:22:52+00:00","modified_at":"2026-10-18T14:16:57+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96424:792","url":null,"severity":null,"published_at":"2026-10-25T03:46:48+00:00","modified_at":"2026-10-25T03:46:48+00:00","first_seen_at":"2026-10-25T03:46:48+00:00","fetched_at":"2026-10-25T03:46:48+00:00","note":"Read UBports advisory (primary), issue #18, NVD/CVE record. Affected <=0.3.2, fixed 0.3.3; Ubuntu Touch 24.04-2.1/1.5. No PoC link or exploitation reported; sibling CVE-2026-96425 (download-manager command exec). How-to-check is my own derivation, not vendor text, so unverified."}],"documents":[{"id":3332,"url":"https://forums.ubports.com/topic/12671/security-advisory-arbitrary-root-command-execution-and-unauthenticated-arbitrary-file-read-as-root-in-lomiri-download-manager","title":"UBports security advisory: lomiri-download-manager / upload-manager","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3333,"url":"https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/18","title":"Issue #18: unauthenticated arbitrary-file-read-as-root in lomiri-upload-manager","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3334,"url":"https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/779dfd5bbeb5fe8877627b772e5024e40eda38aa","title":"Fix commit 779dfd5b","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}