CVE-2026-27447 PUBLISHED

OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup

Assigner: GitHub_M
Reserved: 19.02.2026 Published: 03.04.2026 Updated: 03.04.2026

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains an authorization bypass vulnerability due to case-insensitive username comparison during authorization checks. The vulnerability allows an unprivileged user to gain unauthorized access to restricted operations by using a user with a username that differs only in case from an authorized user. At time of publication, there are no publicly available patches.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
CVSS Score: 4.8

Product Status

Vendor OpenPrinting
Product cups
Versions
  • Version <= 2.4.16 is affected

References

Problem Types

  • CWE-863: Incorrect Authorization CWE