qSnapper includes a time‑to‑check to time‑of‑use vulnerability in its polkit authentication mechanism, allowing a local attacker to bypass the authentication check and operate with elevated privileges, potentially as root.

The vulnerable product is qSnapper from presire. Any deployment running a version earlier than 1.3.3 is affected. The patch that fixes the issue is available in release v1.3.3 and newer.

The CVSS score of 8.1 indicates a high severity risk. Because the exploit is local, it is limited to users who already have local access to the system and there is no current EPSS data or KEV listing, the likelihood is not quantified but the potential for privilege escalation remains significant whenever local users are present.