Lack of authorization of the InputManager D-Bus interface in InputPlumber versions before v0.63.0 can lead to local Denial-of-Service, information leak or even privilege escalation in the context of the currently active…
CVSS 4.0HIGH 8.5·Local·No auth·User interaction·EPSS 0.00203·Published 2026-01-14·Fixed in 0.63.0CWE-863
Polkit authentication dis isabled by default and a race condition in the Polkit authorization check in versions before v0.69.0 can lead to the same issues as in CVE-2025-66005.
CVSS 4.0HIGH 8.5·Local·No auth·User interaction·EPSS 0.00225·Published 2026-01-14·Fixed in 0.63.0CWE-284