CVE-2026-102568
Received Received - Intake

Incorrect Authorization in Pardus Parental Control Allows Root Privilege Escalation

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description
Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including DNS filtering and application limits without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102568
EUVD
EUVD-2026-88969

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pardus parental_control to 0.7.0 (exc)
pardus pardus_parental_control to 0.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Pardus Parental Control before 0.7.0 has an authorization flaw in its polkit policy. Unprivileged local users can exploit this to disable parental controls as root by running PPCActivator.py with the --disable argument via pkexec. This bypasses authentication and removes all restrictions like DNS filtering and application limits.

Detection Guidance

Check if Pardus Parental Control is installed and verify its version. Run 'pkexec PPCActivator.py --disable' to test if the vulnerability exists. If the command executes without authentication, the system is vulnerable.

Impact Analysis

An attacker with local access could disable parental controls entirely, removing protections like DNS filtering and application limits. This could allow unauthorized access to restricted content or applications, potentially exposing users to harmful material or violating usage policies.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by allowing unauthorized users to disable parental controls, potentially exposing sensitive data or enabling unauthorized system access. Weak authentication in parental controls may fail to enforce child protection requirements under these regulations.

Mitigation Strategies

Update Pardus Parental Control to version 0.7.0 or later. Remove or restrict pkexec permissions for PPCActivator.py. Monitor system logs for unauthorized attempts to disable parental controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102568. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart