The vulnerability arises from an incorrect DBus policy in lomiri-upload-manager, part of the lomiri-download-manager suite. The policy allows any local user to issue read requests via DBus that bypass normal file permission checks, giving them the ability to read any file on the system with root privileges. This flaw falls under CWE‑732, Incorrect Permission Assignment.

Affected systems include all installations of UBports' lomiri-download-manager before version 0.3.3. The advisory explicitly states that upgrading to package 0.3.3, or using the patched versions included in Ubuntu Touch 24.04‑1.5 and 24.04‑2.1, resolves the issue. Users running older releases on Ubuntu Touch or other distributions that have not applied the patch remain vulnerable.

The CVSS score of 7.8 signifies a moderate to high impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating it may not yet be actively exploited in the wild. However, the flaw is trivially exploitable by any local user with access to the DBus session, providing read access to arbitrary root‑owned files. Attackers could use this capability to exfiltrate credentials or other sensitive data, potentially enabling further privilege escalation if additional weaknesses are present.