CVE-2026-87876 LOW

CVE-2026-87876: Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Weakness CWE-178
Published September 9, 2026
Last update October 21, 2026
View on NVD All CVEs

CVSS base score

3.0/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Key dates

02Disclosure timeline

September 9, 2026 CVE published
October 21, 2026 Record updated