Pardus Parental Control before version 0.7.0 includes an incorrect authorization flaw in a polkit policy file that allows any local user to run the PPCActivator.py script with the --disable argument as root. This flaw enables attackers to lift all parental restrictions, including DNS blocking and application limits, without authentication, effectively nullifying the intended security controls. The vulnerability is based on improper authorization where a privileged operation is not correctly bound to an authenticated user, as identified by CWE-863.

The affected product is Pardus Parental Control from the Pardus repository. Any installation built with a version earlier than 0.7.0 is vulnerable. Versions 0.7.0 and later incorporate the fix by correcting the polkit policy and removing the authorisation bypass.

The CVSS base score of 6.8 indicates a medium severity vulnerability. Although an EPSS score is not available, the flaw can be exploited by any local user who can invoke pkexec, a common administrative helper, making the attack path straightforward for users with basic local access. The vulnerability is not listed in the CISA KEV catalog, but the ability to fully remove parental controls without authorization still represents a significant risk to families relying on the software. The exploit requires only local user access and the knowledge of the policy paths as exposed in the repository, so it can be executed with minimal effort by an attacker with physical or logged-in access.