The vulnerability arises from a case‑insensitive comparison of usernames during CUPS authorization checks. An attacker who can create or use a user account whose name differs only in case from an authorized user can exercise privileged operations normally reserved for that authorized user. This bypass grants unauthorized access to restricted printing functions, potentially allowing the attacker to query protected information, modify print jobs, or otherwise abuse printing services. The weakness corresponds to improper comparison logic (CWE‑178) and insufficient privilege checks (CWE‑863).

The issue affects the OpenPrinting CUPS printing system for Linux and other Unix‑like operating systems. Vulnerable versions are CUPS 2.4.16 and all earlier releases. The product is maintained by the OpenPrinting project, and the vulnerability is reported in the CUPS daemon (cupsd).

The CVSS score of 4.8 indicates moderate severity. With no EPSS data and not listed in the KEV catalog, the exploitation likelihood is unclear, but the flaw can potentially be leveraged by users who have local or network access to the CUPS service. Based on the description, the attack likely requires an unprivileged user to interact with the CUPS daemon, which could be achieved through a local shell or through network requests if the service is exposed. Because the vulnerability permits an unauthorized privileged operation, successful exploitation would compromise confidentiality, integrity, or availability of the printing infrastructure. Until a patch is published, the risk remains elevated for systems exposing CUPS without proper access controls.