inn: non-root owned files
Priority LOW 36CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new user to escalate their privileges to root. This issue affects: openSUSE Leap 15.2 inn version 2.6.2-lp152.1.26 and prior versions. openSUSE Tumbleweed inn version 2.6.2-4.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.3.3.1 and prior versions.
Why it matters now
EPSS 0.00362 30th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| openSUSE | openSUSE Leap 15.2 | inn – 2.6.2-lp152.1.26 | — | No fix listed | CNA |
| openSUSE | openSUSE Tumbleweed | inn – 2.6.2-4.2 | — | No fix listed | CNA |
| openSUSE | openSUSE Leap 15.1 | inn – 2.5.4-lp151.3.3.1 | — | No fix listed | CNA |
- openSUSE Leap 15.2 VendoropenSUSE Affected inn – 2.6.2-lp152.1.26 Fixed in — No fix listed CNA
- openSUSE Tumbleweed VendoropenSUSE Affected inn – 2.6.2-4.2 Fixed in — No fix listed CNA
- openSUSE Leap 15.1 VendoropenSUSE Affected inn – 2.5.4-lp151.3.3.1 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* | 15.0 sp1 | Vulnerable | openSUSE |
| cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:* | 15.0 sp2 | Vulnerable | openSUSE |
| cpe:2.3:a:opensuse:tumbleweed:*:*:*:*:*:*:*:* | up to 2.6.2-4.2 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | openSUSE |
- cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* Versions 15.0 sp1 Vulnerable ·openSUSE
- cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:* Versions 15.0 sp2 Vulnerable ·openSUSE
- cpe:2.3:a:opensuse:tumbleweed:*:*:*:*:*:*:*:* Versions up to 2.6.2-4.2 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8026
- 2026-10-03 Alias added: GHSA-fm9w-35mc-phwx
References
More openSUSE Backports Sle vulnerabilities
- TI-2020-10051 rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-12611 Buffer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2020-12621 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
- TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
- TI-2020-16362 An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-8026 · CVE Program
- CVE-2020-8026 · NVD
- FIRST EPSS
- GHSA-fm9w-35mc-phwx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences