TI-2026-65428 Aliases CVE-2026-102568 GHSA-pvcf-vf9x-g9pj

Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py

MEDIUM 63CWE-863Published 2026-09-29 · Updated 2026-09-29

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including DNS filtering and application limits without authentication.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00172 6th percentileScored 2026-11-07

Fix Fixed pardus-parental-control (pardus): 0.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pardus	pardus-parental-control	before 0.7.0	0.7.0	Patch available	CNA

pardus-parental-control Vendorpardus Affected before 0.7.0 Fixed in 0.7.0 Patch available CNA

Remediation

Fix · CNA pardus-parental-control (pardus) Fixed in 0.7.0

Timeline

2026-10-02 Threatist record created from CVE-2026-102568
2026-10-03 Alias added: GHSA-pvcf-vf9x-g9pj

References

Patch 2

Other 3

TI-2021-02756 Missing Authorization Checks in LiderAhenk CVSS 3.1CRITICAL 9.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences