TI-2026-21858 Aliases CVE-2026-27447

OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup

MEDIUM 61CWE-863Published 2026-04-03 · Updated 2026-04-06

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · Low · None
Fix status: Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains an authorization bypass vulnerability due to case-insensitive username comparison during authorization checks. The vulnerability allows an unprivileged user to gain unauthorized access to restricted operations by using a user with a username that differs only in case from an authorized user. At time of publication, there are no publicly available patches.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00295 22nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenPrinting	cups	up to 2.4.16	—	No fix listed	CNA

cups VendorOpenPrinting Affected up to 2.4.16 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openprinting:cups::::::::	up to 2.4.16	Vulnerable	OpenPrinting

cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* Versions up to 2.4.16 Vulnerable ·OpenPrinting

Remediation

Red Hat 1 advisory

RHSA-2026:8814 Released 2026-04-17 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images cups-2.4.17-1.hum1@aarch64, cups-2.4.17-1.hum1@src, cups-2.4.17-1.hum1@x86_64 +14

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:8814

Timeline

2026-10-02 Threatist record created from CVE-2026-27447

References

Exploit 1

https://github.com/OpenPrinting/cups/security/advisories/GHSA-v987-m8hp-phj9

Patch 1

https://github.com/OpenPrinting/cups/commit/88516bf6d9e34cef7a64a704b856b837f70cd220

TI-2025-35903 cups has Authentication bypass with AuthType Negotiate CVSS 3.1HIGH 8.0
TI-2023-17077 CUPS vulnerable to use-after-free in cupsdAcceptClient() CVSS 3.1HIGH 7.1
TI-2026-27200 Path traversal in OpenPrinting cups CVSS 3.1MEDIUM 6.5
TI-2023-04157 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow CVSS 3.1HIGH 7.0
TI-2026-74874 Path traversal in OpenPrinting CUPS banner handling discloses files CVSS 3.1MEDIUM 5.3
TI-2026-27201 OpenPrinting CUPS: Heap overflow in `get_options()` CVSS 3.1MEDIUM 5.3

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences