CVE-2026-41047 Details
Description
Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacker to see otherwise read protected information.
An information disclosure vulnerability has been identified in qSnapper versions prior to 1.3.3. The issue arises from a lack of proper authentication in the D-Bus service, allowing local attackers to access read-protected information. This vulnerability is particularly concerning because it enables unauthorized users to exploit the 'snapshot diff' functions, potentially leaking sensitive data such as password details from the '/etc/shadow' file.
Users can upgrade to qSnapper version 1.3.3, which addresses this vulnerability by implementing proper authentication checks and removing the caching of authentication that allowed for bypasses.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.suse.com/show_bug.cgi?id=1261890 | [email protected] | Third Party Advisory |
| https://github.com/presire/qSnapper/releases/tag/v1.3.3 | [email protected] | Release Notes |
| https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html#issue-info-leak | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| presire qsnapper | < 1.3.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | Reanalysis | [email protected] |
| Jun 28, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |