CVE-2026-19816

High

Description

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.

SeverityHigh

CVSS7.1

Exploit probability—

Product

Packagekit

PublishedSep 14, 2026

First seenSep 14, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

PackageKit1.4.0 or later
Fedora Fedora1.4.0 or later

Patches

github.com/PackageKit/PackageKit/commit/33be77b3ecd3b566ca117358dc18c58c964e627b

Vendor advisories

github.com/PackageKit/PackageKit/security/advisories/GHSA-g5gf-h68q-gxc8

Affected products

Product	Affected versions	Fixed in
PackageKit	1.3.4 ≤ v < 1.4.0	1.4.0
Fedora Fedora	1.3.4 ≤ v < 1.4.0	1.4.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.