Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2550

NIXPKGS-2026-2550
published 8 hours ago
Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)
Permalink CVE-2026-87876
3.0 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Adjacent (A)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Adjacent (A)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 8 hours ago by @LeSuisse Activity log
  • Created suggestion 18 hours ago
  • @LeSuisse ignored
    66 packages
    • apcupsd
    • cups-bjnp
    • cups-dymo
    • carps-cups
    • cups-zj-58
    • cups-browsed
    • cups-filters
    • cups-kyocera
    • cups-printers
    • gutenprintBin
    • cups-kyodialog
    • cups-pk-helper
    • gutenprint-bin
    • libcupsfilters
    • canon-cups-ufr2
    • cups-idprt-tspl
    • cups-pdf-to-pdf
    • cups-idprt-mt888
    • cups-idprt-mt890
    • cups-idprt-sp900
    • cups-idprt-barcode
    • brgenml1cupswrapper
    • mfc465cncupswrapper
    • cups-brother-dcpt310
    • cups-toshiba-estudio
    • dcp375cw-cupswrapper
    • magicard-cups-driver
    • mfc5890cncupswrapper
    • mfcj880dwcupswrapper
    • perlPackages.NetCUPS
    • dcpj785dw-cupswrapper
    • mfc9140cdncupswrapper
    • mfcj470dw-cupswrapper
    • mfcl2700dncupswrapper
    • mfcl2720dwcupswrapper
    • mfcl2740dwcupswrapper
    • perl5Packages.NetCUPS
    • cups-brother-dcpt720dw
    • cups-brother-dcpt725dw
    • cups-brother-hl3150cdn
    • cups-brother-hl3170cdw
    • cups-brother-mfcl2710dw
    • cups-brother-mfcl2800dw
    • cups-brother-dcp1610wlpr
    • python313Packages.pycups
    • mfcl8690cdwcupswrapper
    • mfcl3770cdwcupswrapper
    • mfcj6510dw-cupswrapper
    • dcp9020cdw-cupswrapper
    • cups-kyocera-3500-4500
    • cups-brother-hll2375dw
    • cups-brother-hll2350dw
    • cups-brother-hl3140cw.x86_64-linux
    • cups-brother-hl1110.x86_64-linux
    • cups-kyocera-ecosys-m552x-p502x
    • gnomeExtensions.apcups-monitor
    • prometheus-apcupsd-exporter
    • mfcj470dwlpr.x86_64-linux
    • python314Packages.pycups
    • cups-brother-dcpl3550cdw
    • cups-brother-dcpl2550dw
    • cups-brother-hll3230cdw.x86_64-linux
    • cups-brother-hl1210w.x86_64-linux
    • cups-brother-hl2260d.x86_64-linux
    • cups-brother-hll2340dw.x86_64-linux
    • cups-brother-mfcl2750dw
    8 hours ago
  • @LeSuisse accepted 8 hours ago
  • @LeSuisse published on GitHub 8 hours ago
Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Affected products

cups
rhel9/cups
rhcos/rhcos

Matching in nixpkgs

Ignored packages (66)

pkgs.cups-browsed

Daemon for browsing the Bonjour broadcasts of shared, remote CUPS printers

pkgs.cups-filters

Backends, filters, and other software that was once part of the core CUPS distribution but is no longer maintained by Apple Inc

pkgs.cups-kyocera

CUPS drivers for several Kyocera FS-{1020,1025,1040,1060,1120,1125} printers

pkgs.cups-pk-helper

PolicyKit helper to configure cups with fine-grained privileges

pkgs.libcupsfilters

Backends, filters, and other software that was once part of the core CUPS distribution but is no longer maintained by Apple Inc

pkgs.cups-idprt-tspl

CUPS drivers for TSPL-based iDPRT thermal label printers (SP210, SP310, SP320, SP320E, SP410, SP410BT, SP420, SP450, SP460BT)

pkgs.cups-idprt-barcode

CUPS drivers for iDPRT barcode printers (iD2P, iD2X, iD4P, iD4S, iE2P, iE2X, iE4P, iE4S, iT4B, iT4E, iT4P, iT4S, iT4X, iX4E, iX4L, iX4P, iX4E, iX6P)

pkgs.cups-toshiba-estudio

Printer only driver for the Toshiba e-STUDIO class of printers

  • nixos-unstable 7.89
    • nixpkgs-unstable 7.89
    • nixos-unstable-small 7.89
  • nixos-26.05 7.89
    • nixos-26.05-small 7.89
    • nixpkgs-26.05-darwin 7.89

pkgs.gnomeExtensions.apcups-monitor

A subtle UPS load monitor for the panel. If you have an APC UPS.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4