CVE-2026-59678: PortProtonQt Auth Bypass Vulnerability

CVE-2026-59678 Overview

CVE-2026-59678 is an incorrect authorization vulnerability in Linux-Gaming PortProtonQt. The flaw allows any local user to mount and unmount arbitrary file systems and modify network configuration through NetworkManager. The vulnerability is classified under [CWE-863: Incorrect Authorization]. It affects all versions of PortProtonQt before commit 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe. The issue is exploitable locally without authentication or user interaction, providing attackers with high integrity and availability impact on affected Linux systems.

Critical Impact
Any local user can mount arbitrary file systems and reconfigure networking via NetworkManager, bypassing normal authorization controls on the host.

Affected Products

Linux-Gaming PortProtonQt versions prior to commit 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe
Linux distributions packaging vulnerable PortProtonQt builds
Systems using NetworkManager alongside PortProtonQt

Discovery Timeline

2026-07-23 - CVE CVE-2026-59678 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-59678

Vulnerability Analysis

PortProtonQt is a Qt-based front end for the PortProton Linux gaming compatibility layer. The application exposes privileged operations to unprivileged local users without properly verifying authorization. Two operations are affected: file system mounting and unmounting, and network configuration changes performed through NetworkManager. An attacker with a local account on the system can invoke these operations directly, circumventing the access controls normally enforced by Polkit or equivalent authorization frameworks. The impact includes unauthorized data access through arbitrary mounts, denial of service by unmounting critical file systems, and network redirection through NetworkManager settings changes.

Root Cause

The root cause is missing or insufficient authorization checks in the PortProtonQt privileged action handlers. The application does not validate that the caller is entitled to perform mount, unmount, and NetworkManager operations. This maps to [CWE-863: Incorrect Authorization], where authorization logic exists but is applied incorrectly, allowing operations that should be restricted to privileged users.

Attack Vector

Exploitation requires local access to the target system with any user account. No elevated privileges, authentication, or user interaction is required. An attacker invokes the exposed PortProtonQt interfaces to trigger mount, unmount, or NetworkManager operations. Successful exploitation can expose file systems from removable devices or attacker-controlled sources, disrupt system services by unmounting active volumes, and manipulate DNS or routing through NetworkManager to enable interception of traffic.

No verified proof-of-concept code is publicly available. See the SUSE Bugzilla entry for CVE-2026-59678 for further technical details.

Detection Methods for CVE-2026-59678

Indicators of Compromise

Unexpected mount or umount operations initiated by non-root users while PortProtonQt is running
Unauthorized changes to NetworkManager connections, DNS settings, or routing tables
Presence of PortProtonQt binaries at versions preceding commit 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe
New mount points appearing in /proc/mounts that do not correspond to system or user session activity

Detection Strategies

Audit mount, umount2, and NetworkManager D-Bus calls using auditd rules and correlate the initiating UID with expected system accounts
Monitor NetworkManager logs in /var/log/NetworkManager and journald for configuration changes originating from PortProtonQt processes
Compare installed PortProtonQt commit hashes against the fixed revision to identify vulnerable hosts

Monitoring Recommendations

Enable Linux audit rules for the mount and umount2 syscalls and forward events to a centralized logging platform
Track D-Bus method calls to org.freedesktop.NetworkManager from unexpected process contexts
Alert on file system mounts occurring outside standard user session lifecycle events

How to Mitigate CVE-2026-59678

Immediate Actions Required

Update PortProtonQt to a version that includes commit 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe or later
Restrict local access to systems running vulnerable PortProtonQt builds until patched
Review NetworkManager and mount table state on affected hosts for unauthorized changes

Patch Information

The fix is delivered in PortProtonQt commit 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe. Rebuild or upgrade to a package that includes this commit. Distribution-specific updates are tracked in the SUSE Bugzilla entry for CVE-2026-59678.

Workarounds

Remove or disable PortProtonQt on shared or multi-user systems until the patched version is deployed
Enforce Polkit rules that require administrator authentication for org.freedesktop.NetworkManager.settings.modify.system and mount-related actions
Limit access to the PortProtonQt executable using file permissions so only trusted users can launch it

bash

# Verify installed PortProtonQt commit and restrict execution
cd /path/to/PortProtonQt && git rev-parse HEAD
sudo chmod 750 /usr/bin/PortProtonQt
sudo chown root:trusted-gamers /usr/bin/PortProtonQt