A flaw in dnf5daemon-server permits an attacker to manipulate another user's D‑Bus session because session methods do not verify the caller is the original session owner. The attacker can replace the resolved package‑management transaction plan of that session. If the legitimate user later authorizes execution, the root daemon will apply the attacker‑chosen package operations, effectively installing malicious or undesired packages with root privileges.

Affected systems are Red Hat Hardened Images containing the dnf5daemon-server component. No specific version range is provided in the CNA data, so all currently installed copies of this component are potentially vulnerable until an updated build is released.

The vulnerability has a CVSS score of 6.6 and is not listed in the CISA KEV catalog. The EPSS score is unavailable, indicating that public exploitation data is not yet known. A local attacker who can access the system D‑Bus can subvert another user's package‑management session, replacing its transaction plan. If the legitimate session owner later confirms the operation, the root daemon will execute the attacker‑chosen packages, leading to elevation of privilege and full system compromise. Because the flaw relies on a local environment and the session bus is typically accessible to all users on a multi‑user system, the risk is moderate but significant.