On Thu, 09 Apr 2026 at 02:32:56 +0200, Solar Designer wrote:
Arbitrary read-access to files in the system-helper context
...
A malicious user can get read-access to files in the system-helper
context if a system OCI repository is configured.
We weren't sure whether this one is even a vulnerability, and only
handled it like a vulnerability out of an abundance of caution, hence
the lack of CVE ID. I can't think of a real-world situation where there
would be files that are readable by the unprivileged system uid that is
used by the flatpak-system-helper process ("_flatpak" on Debian/Ubuntu,
or some similar name on other distros), but not readable by the user who
is running flatpak.
smcv
