CVE-2026-87876

Awaiting Analysis Awaiting Analysis - Queue

CUPS Scheduler Username Comparison Bypass

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: redhat-SADP

Description

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-10

EPSS Evaluated

N/A

NVD

CVE-2026-87876

EUVD

EUVD-2026-75089

Affected Vendors & Products

Vendor	Product	Version / Range
openprinting	cups	to 2.4.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-178	The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

Executive Summary

CVE-2026-87876 is a vulnerability in CUPS (Common UNIX Printing System) affecting its scheduler component. It involves two case-insensitive username comparisons performed outside the main authorization path, which could allow attackers to bypass username-based access controls in certain configurations. The issue is related to improper handling of case sensitivity in usernames derived from IPP requests.

Detection Guidance

Check CUPS version with 'cups-config --version' or 'rpm -q cups' on Linux. Inspect scheduler logs for IPP request handling anomalies. Monitor for unauthorized access attempts or privilege escalation in printer ACL logs. Review code paths in scheduler/ipp.c and scheduler/policy.c for case-insensitive username comparisons.

Impact Analysis

This vulnerability could allow unauthorized access or privilege escalation if exploited. Attackers with adjacent network access could bypass access controls by manipulating username case variations. The impact is limited due to low CVSS score (3.0) and requires low privileges and specific configurations.

Compliance Impact

This vulnerability involves case-insensitive username comparisons in CUPS that could allow bypassing access controls. While it may impact data confidentiality by enabling unauthorized access to sensitive print jobs or user data, there is no direct evidence in the provided context linking this specific issue to GDPR or HIPAA compliance requirements. The vulnerability's low CVSS score and limited scope suggest minimal regulatory impact unless exploited in environments handling highly regulated data.

Mitigation Strategies

Update CUPS to version 2.4.20 or later. Apply patches from OpenPrinting/cups GitHub repository commits 88e67c0 and f56844d. Restrict network access to CUPS scheduler ports. Monitor for unusual IPP requests or access patterns. Disable unnecessary printer ACLs until patched.

Hi! I’m here to help you understand CVE-2026-87876. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70