# CVE-2026-41048: presire qSnapper authentication bypass via shared m_authenticated flag

Source: https://junglewise.ai/threats/cve-2026-41048-presire-qsnapper-authentication-bypass-via-shared-m-authenticated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-41048 · Severity: info · CVSS 8.4 · Published 2026-06-22

qSnapper, a tool used to manage system backups and snapshots, contains a flaw in how it handles user permissions. An attacker with limited access to a computer could trick the system into granting them higher-level permissions, such as the ability to restore or revert system states, even if they were only authorized to perform minor tasks like deleting a backup. This could lead to unauthorized system changes or data loss.

Technologies: [Presire qSnapper](https://junglewise.ai/threats/technologies/qsnapper). Vendors: [Presire](https://junglewise.ai/threats/vendors/presire).

## Quick answers

**Is CVE-2026-41048 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41048 being exploited in the wild.

**How severe is CVE-2026-41048?** Informational severity, with a CVSS score of 8.4, published 22 June 2026.

**Which products and versions are affected?** Presire qSnapper >= 1.2.1, < 1.3.3.

**Is there a fix for CVE-2026-41048?** A patch was published on 2026-05-25: Upstream version 1.3.3 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41048 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-41048?** Check whether you run Presire qSnapper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the qSnapper D-Bus daemon (qsnapper-dbus-service) due to the incorrect implementation of an internal authentication cache. The daemon used a shared 'm_authenticated' flag that, once set by a successful Polkit authorization, would bypass subsequent checks for different actions. For example, a user authorized for the 'delete-snapshot' action would implicitly gain authorization for 'rollback-snapshot' because the flag remained set. Additionally, because the flag was shared across the service instance, one user's successful authentication could allow other unprivileged users (including 'nobody') to execute protected D-Bus methods. This has been fixed in version 1.3.3 by removing the internal cache and relying on Polkit's native 'auth_admin_keep' behavior.

## Affected products

- presire qSnapper >= 1.2.1, < 1.3.3

## Timeline

- 2026-04-16: disclosed: Vulnerability identified during SUSE security review.
- 2026-05-25: patched: Upstream version 1.3.3 released.
- 2026-06-22: advisory: NVD publication date.

## References

- [https://bugzilla.suse.com/show_bug.cgi?id=1262218](https://bugzilla.suse.com/show_bug.cgi?id=1262218)
- [https://github.com/presire/qSnapper/releases/tag/v1.3.3](https://github.com/presire/qSnapper/releases/tag/v1.3.3)
- [https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html](https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html)

## Related threats

- [presire qSnapper authentication bypass via shared auth caching](https://junglewise.ai/threats/cve-2026-41049-presire-qsnapper-authentication-bypass-via-shared-auth-caching)
- [presire qSnapper information disclosure in snapshot diff functions](https://junglewise.ai/threats/cve-2026-41047-presire-qsnapper-information-disclosure-in-snapshot-diff)
- [presire qSnapper path traversal in configName parameter](https://junglewise.ai/threats/cve-2026-41046-presire-qsnapper-path-traversal-in-configname-parameter)
- [presire qSnapper Polkit authentication bypass via TOCTOU race condition](https://junglewise.ai/threats/cve-2026-41045-presire-qsnapper-polkit-authentication-bypass-via-toctou-race)