---
id: CVE-2026-96283
title: >-
  By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's
  pull, the pull is not actually cancelled but removed from internal tracking,
  making it impossible for the owning user to stop it
summary: >-
  By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's
  pull, the pull is not actually cancelled but removed from internal tracking,
  making it impossible for the owning user to stop it. Ongoing pulls cannot be
  stopped.
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-862
vendor: Red Hat
product: flatpak
affected:
  - flatpak (all versions)
  - flatpak (all versions)
  - flatpak (all versions)
  - flatpak (all versions)
published: '2026-09-27'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T21:29:07.663'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-96283'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-96283'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2539424'
    label: secalert@redhat.com
  - url: 'https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-96283.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-96283'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-96283'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00106
epssPercentile: 0.01113
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-28T13:32:31.877226Z'
ingestedAt: '2026-09-27T22:59:18.878Z'
---

## Overview

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-09-27 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-96283.json)