CVE-2022-26691
cups: authorization bypass when using "local" authorization
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · May 26, 2022
Updated · November 22, 2025
Description
An authorization vulnerability was found in the CUPS printing system. This security vulnerability occurs when local authorization happens. This flaw allows an attacker to authenticate to CUPS as root/admin without the 32-byte secret key and perform arbitrary code execution.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Red Hat has investigated whether possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
CVSS / CWE
CVSS 3.1 · 6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-288 · Authentication Bypass Using an Alternate Path or Channel