CVE-2026-27447

MEDIUM

OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup

Title source: cna

Description

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains an authorization bypass vulnerability due to case-insensitive username comparison during authorization checks. The vulnerability allows an unprivileged user to gain unauthorized access to restricted operations by using a user with a username that differs only in case from an authorized user. At time of publication, there are no publicly available patches.

Scores

CVSS v3 4.8
EPSS 0.0001
EPSS Percentile 1.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (2)
openprinting/cups < 2.4.16
OpenPrinting/cups <= 2.4.16
Published Apr 03, 2026
Tracked Since Apr 04, 2026