CVE-2026-8304: Pardus About Auth Bypass Vulnerability

CVE-2026-8304 Overview

CVE-2026-8304 is a missing authorization vulnerability [CWE-862] affecting TUBITAK BILGEM Software Technologies Research Institute's Pardus About component. The flaw stems from incorrectly configured access control security levels within the application. A local authenticated attacker with low privileges can exploit the weakness to access information that should be restricted by proper authorization checks. The issue affects Pardus About versions from 1.2.1 before 1.2.5.

Critical Impact
A local low-privileged user can bypass access control restrictions in Pardus About to disclose sensitive information without requiring user interaction.

Affected Products

TUBITAK BILGEM Pardus About 1.2.1
TUBITAK BILGEM Pardus About versions between 1.2.1 and 1.2.5
TUBITAK BILGEM Pardus About prior to 1.2.5

Discovery Timeline

2026-09-11 - CVE CVE-2026-8304 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-8304

Vulnerability Analysis

The vulnerability resides in the Pardus About component, part of the Pardus Linux distribution developed by TUBITAK BILGEM. Pardus About typically surfaces system and distribution metadata to users. Because the component does not enforce required authorization checks, a locally authenticated attacker with low privileges can reach protected functionality or data intended for higher-privileged contexts. Exploitation requires local access and no user interaction. Successful exploitation results in confidentiality impact only; integrity and availability of the host are not affected. The scope remains unchanged, meaning the compromised component does not extend impact beyond its own security authority.

Root Cause

The root cause is an authorization control gap classified under [CWE-862] Missing Authorization. The application performs sensitive operations or data retrieval without validating that the invoking user holds the required security level. Access control policies exist but are incorrectly configured, so restricted functions execute for callers who should be denied.

Attack Vector

Exploitation requires local access to a system running an affected Pardus About version. The attacker must possess valid low-privileged credentials on the host. Once authenticated, the attacker invokes the vulnerable functionality directly to retrieve information that authorization policy should have blocked. No social engineering or victim interaction is needed. Further technical details are published in Siber Güvenlik Notification #TR-26-1082.

Detection Methods for CVE-2026-8304

Indicators of Compromise

Unexpected invocations of Pardus About functionality by non-administrative user accounts on Pardus endpoints.
Presence of Pardus About package versions in the range 1.2.1 through 1.2.4 on managed Linux systems.
Local process execution chains where standard user shells spawn Pardus About interfaces outside normal desktop session flows.

Detection Strategies

Inventory installed Pardus About package versions across the fleet and flag any instance below 1.2.5.
Monitor authentication and process telemetry on Pardus hosts for low-privileged accounts accessing system information interfaces.
Correlate local user activity with unusual reads of Pardus system metadata that would normally require elevated context.

Monitoring Recommendations

Ingest Linux endpoint audit logs (auditd) covering process execution and file access on Pardus systems.
Track package management events (apt, dpkg) to confirm upgrade status of the Pardus About component.
Alert on repeated local invocations of the affected component by the same non-privileged user within short time windows.

How to Mitigate CVE-2026-8304

Immediate Actions Required

Upgrade Pardus About to version 1.2.5 or later on all affected Pardus systems.
Audit local user accounts on Pardus hosts and remove unnecessary interactive access.
Review authorization configuration on Pardus endpoints to confirm least-privilege enforcement for system information components.

Patch Information

TUBITAK BILGEM addresses the missing authorization defect in Pardus About 1.2.5. Administrators should apply the fixed release through standard Pardus package management channels. Refer to the Siber Güvenlik Notification #TR-26-1082 for vendor-published remediation guidance.

Workarounds

Restrict local shell access to Pardus systems to trusted administrative users until patching is complete.
Remove or disable the Pardus About component on hosts where it is not required for operational use.
Apply host-level access controls that limit execution of the affected binary to privileged accounts.

bash

# Configuration example
# Verify installed version and upgrade Pardus About on affected hosts
dpkg -l | grep -i pardus-about
sudo apt update
sudo apt install --only-upgrade pardus-about
dpkg -l | grep -i pardus-about