Flatpak creates temporary child repository directories under the user cache with world‑writable permissions (0777). Because the directories can be modified by any local user on a multi‑user system with a permissive umask, an attacker could alter the contents of a repository while it is being installed or updated. The altered content would fail signature or digest verification, causing the installation process to abort rather than gain malicious privileges. The primary effect is therefore a denial of service to application or runtime installation, not remote code execution or data exfiltration.

The vulnerability affects Red Hat Enterprise Linux 7, 8, 9, and 10 systems that run Flatpak. No specific Flatpak or ELS version numbers were provided, so all builds of Flatpak installed on these operating system releases are potentially impacted. System administrators should check whether the Flatpak helper binaries on their servers use the default cache paths described in the advisory.

The CVSS vector assigns a score of 3.9, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that no active exploitation is widely reported. The likely attack vector is local; an attacker must have user‑level access on the same machine to manipulate the world‑writable cache directories. In the absence of a fixed patch, the defect can be mitigated by preventing write permissions on the cache path, thereby limiting the possibility of installation failures. Because the flaw does not allow privilege escalation or direct code execution, the overall risk to confidentiality or integrity remains low, but the availability impact warrants timely remediation.