Improper Handling of Case Sensitivity in cups - CVE-2026-87876
Published: October 9, 2026
Vulnerability details
The vulnerability allows a remote user to influence whether private job or subscription attributes are filtered.
The vulnerability exists due to improper handling of case sensitivity in scheduler/policy.c:cupsdGetPrivateAttrs() when processing IPP requests for job or subscription attributes. A remote user can submit a request containing a case-variant username to influence whether private job or subscription attributes are filtered.
JobPrivateAccess or SubscriptionPrivateAccess must include @OWNER or an explicit username. The supplied CVSS assessment requires adjacent-network access and user interaction. The advisory does not establish a distinct security boundary bypass beyond the documented request-supplied username trust model.
Affected software
openEuler
cups-client
cups
cups-help
cups-filesystem
cups-printerapp
cups-lpd
cups-libs
cups-ipptool
cups-devel
cups-debugsource
cups-debuginfo
How to mitigate CVE-2026-87876
cups-client - addressed in versions 2.4.0-22, 2.4.7-17
cups - addressed in versions 2.4.0-22, 2.4.7-17
cups-help - addressed in versions 2.4.0-22, 2.4.7-17
cups-filesystem - addressed in versions 2.4.0-22, 2.4.7-17
cups-printerapp - addressed in versions 2.4.0-22, 2.4.7-17
cups-lpd - addressed in versions 2.4.0-22, 2.4.7-17
cups-libs - addressed in versions 2.4.0-22, 2.4.7-17
cups-ipptool - addressed in versions 2.4.0-22, 2.4.7-17
cups-devel - addressed in versions 2.4.0-22, 2.4.7-17
cups-debugsource - addressed in versions 2.4.0-22, 2.4.7-17
cups-debuginfo - addressed in versions 2.4.0-22, 2.4.7-17