This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-87876 →

DEBIAN-CVE-2026-87876

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and priv...

Original description

The description as published by the source.

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 cups

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 cups

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 cups

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org