CVE-2026-87876

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Two case-insensitive comparisons on request-derived usernames remain in the CUPS scheduler outside the main authorization path, in the printer ACL validation logic (check_quotas() in scheduler/ipp.c) and the private-attribute filtering logic (cupsdGetPrivateAttrs() in scheduler/policy.c), and were not addressed by the fix for CVE-2026-27447. In certain configurations, an authenticated attacker on the adjacent network could use these comparisons to bypass username-based access controls and access information protected by those controls, resulting in a limited loss of confidentiality with no impact on integrity or availability. Red Hat and upstream both rate this flaw LOW severity (CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N), as exploitation requires an adjacent-network position, an authenticated low-privilege account, and user interaction. The cups component in Red Hat Enterprise Linux, Red Hat OpenShift Container Platform (RHCOS), and Red Hat In-Vehicle OS is affected, with the fix deferred to a future update; given the low severity rating and the prerequisites for exploitation, the residual risk of deferring the fix is considered limited. Fedora and Red Hat Hardened Images are also affected: the Fedora fix is being pursued with the community, and a fix has already been delivered for Red Hat Hardened Images.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Fixed on upstream master branch with commit f56844d and for versions 2.4.x with commit 88e67c0.