Description
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus
Published: 2026-10-16
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary command execution as root via DBus
Action: Immediate Patch
AI Analysis

Impact

The flaw arises from an incorrect DBus policy in lomiri-download-manager that allows any local user to invoke privileged operations. This enables an attacker to run arbitrary commands with root privileges, jeopardizing the confidentiality, integrity, and availability of the system. The weakness is categorized as CWE‑732.

Affected Systems

The vulnerability affects the UBports lomiri-download-manager package. Versions older than 0.3.3 are susceptible. The fix is delivered in lomiri-download-manager 0.3.3 and in Ubuntu Touch releases 24.04‑2.1 and 24.04‑1.5.

Risk and Exploitability

The CVSS score of 5.5 reflects moderate severity, but the capability for arbitrary root execution is a high impact. No EPSS score is available and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring the attacker to have access to the system’s DBus service to trigger the improperly granted method.

Generated by OpenCVE AI on October 16, 2026 at 19:44 UTC.

Remediation

Vendor Solution

Upgrade lomiri-download-manager to 0.3.3, or obtain patched version from your distro. If running Ubuntu Touch, fixed versions are included in Ubuntu Touch 24.04-2.1 and 24.04-1.5.

OpenCVE Recommended Actions

  • Upgrade lomiri-download-manager to version 0.3.3 or later, or apply the relevant package update on Ubuntu Touch to 24.04‑2.1 or 24.04‑1.5.
  • Configure the system’s package manager to install security updates automatically for lomiri-download-manager.
  • If an immediate upgrade is not feasible, disable or lock the lomiri-download-manager DBus interface until the patch is applied.

Generated by OpenCVE AI on October 16, 2026 at 19:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Ubports
Ubports lomiri-download-manager
Vendors & Products Ubports
Ubports lomiri-download-manager

Sun, 18 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus
Title Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
Weaknesses CWE-732
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Ubports Lomiri-download-manager
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-10-18T13:54:07.958Z

Reserved: 2026-09-23T05:42:10.661Z

Link: CVE-2026-96425

cve-icon Vulnrichment

Updated: 2026-10-18T13:47:32.819Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T16:22:52.693

Modified: 2026-10-18T14:16:57.273

Link: CVE-2026-96425

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:54:56Z

Weaknesses
  • CWE-732

    Incorrect Permission Assignment for Critical Resource