{"id":"CVE-2026-96425","kind":"vulnerability","aliases":["CVE-2026-96425"],"related":[],"title":"lomiri-download-manager: loose DBus policy lets local users run root commands","description":"Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus","summary":"The DBus policy for lomiri-download-manager is configured incorrectly, so any local user can call its interface. An attacker who can reach that bus can get a command run as root.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dbus","linux-desktop","lomiri","package"],"not_affected_if":["not-installed"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T16:22:52+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:14:07+00:00","updated_at":"2026-10-25T04:14:07+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:14:07Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"lomiri-download-manager: loose DBus policy lets local users run root commands","impact":"high","summary":"The DBus policy for lomiri-download-manager is configured incorrectly, so any local user can call its interface. An attacker who can reach that bus can get a command run as root.","category":"package","nicknames":[],"who_cares":["lomiri","linux-desktop","dbus"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local user runs arbitrary commands as root","analyst_note":"Find the affected versions and the fixed release from the NVD entry or the upstream Lomiri project advisory, and confirm the default DBus policy shipped.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Systems that install lomiri-download-manager, the download service for the Lomiri desktop, are exposed. The sources do not name affected versions or say whether the service runs on default installs. Teams not running Lomiri can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000527,"input_tokens":3264,"output_tokens":401,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-96425':16A,19A 'allow':67C 'arbitrari':68C,72C 'attack':46B 'bus':51B 'call':42B 'command':13A,55B,73C 'configur':35B 'cve':14A,17A 'dbus':6A,20B,27B,60C,77C 'desktop':23B 'download':3A,32B,65C 'get':53B 'incorrect':36B,59C 'interfac':44B 'let':8A 'linux':22B 'linux-desktop':21B 'local':9A,39B 'lomiri':2A,24B,31B,64C 'lomiri-download-manag':1A,30B,63C 'loos':5A 'manag':4A,33B,66C 'packag':25B 'polici':7A,28B,61C 'reach':49B 'root':12A,58B,75C 'run':11A,56B,71C 'user':10A,40B,69C","nicknames":[],"mitigations":[],"who_affected":"Systems that install lomiri-download-manager, the download service for the Lomiri desktop, are exposed. The sources do not name affected versions or say whether the service runs on default installs. Teams not running Lomiri can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:22:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96425","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96425","severity":null,"published_at":"2026-10-16T16:22:52+00:00","modified_at":"2026-10-18T14:16:57+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}