CVE-2026-59678 PUBLISHED

portprotonqt allows any users to mount and unmount arbitrary file systems and modify the network configuration via NetworkManager

Assigner: suse
Reserved: 06.07.2026 Published: 23.07.2026 Updated: 23.07.2026

An Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any users to mount and unmount arbitrary file systems and modify the network configuration via NetworkManager.

This issue affects PortProtonQt before 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 7.1

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	Low	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Linux-Gaming
Product	PortProtonQt
Versions	Default: unaffected affected from 0 to 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe (excl.)

Credits

Matthias Gerstner of SUSE finder

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59678

Problem Types

CWE-863: Incorrect Authorization CWE