DISCLOSURE NOTES / 19 OCTOBER 2026
Two CVEs, two different trust boundaries.
Research notes on Linux authorization and WordPress access control.
These records concern different components and different security boundaries. Each entry links to the public record and the corresponding research repository.
CVE-2026-7867 · udisks2
PUBLIC VENDOR RECORD
Research into authorization handling in udisks2, focusing on the relationship between a caller’s identity and privileged mount operations. Discovered and reported with Özlem Ozan.
Red Hat’s public record credits Azizcan Daştan and Özlem Ozan and rates the issue Important (CVSS 3.1: 7.8). The issue involves insufficient authorization of the as-user option and requires a local attacker with an active console session. See the vendor record and linked upstream advisory for affected versions and remediation.
CVE-2026-110896 · Passster
PUBLISHED / 16 OCTOBER 2026
A missing-authorization issue in the WordPress Passster plugin, affecting versions through 4.3.18 and fixed in 4.3.19. Patchstack credits azqzazq1 as the finder.
The published severity is CVSS 3.1 5.3 (Medium), while Patchstack assigns a Low priority. The reported impact is limited access-control exposure, not remote code execution, privilege escalation, or a site takeover.
The accompanying repository documents manual source review and a passive version checker. That checker is not an exploit or definitive proof that a particular installation is vulnerable.