A local user who has an active login session on a multi‑user system can exploit the Flatpak system‑helper RemoveLocalRef method to delete a system‑wide Flatpak application’s remote reference. Because the internal anti‑downgrade mechanism relies on the presence of this reference to check the install date, removing it causes the expiry check to fail and allows the older, unpatched version of the application to be installed. This flaw manifests as an Improper Access Control (CWE‑284) issue and can result in any other users on the same host running a downgraded application that may contain known vulnerabilities.

The vulnerability affects Red Hat Enterprise Linux 7, 8, 9, and 10 whenever system‑wide Flatpak applications are installed. The affected platforms are the listed Red Hat distributions and any system that uses the same Flatpak machinery for system applications.

The CVSS score of 6.2 indicates moderate severity. No EPSS data is available, and the issue is not listed in CISA’s KEV catalog, implying that exploitation has not been observed widely. An attacker only needs a normal, non‑privileged local user account that can log in to the target machine; the vulnerability is easy to trigger in shared workstations or desktops. While it does not provide remote code execution, the downgrade can expose all users of the affected host to unpatched vulnerabilities, potentially compromising confidentiality, integrity, and availability.