CVE-2026-87876
Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.
Scoring
- Severity
- LOW
- CVSS base score
- 3
- CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
- CWE
- CWE-178
- Published
- 2026-09-09
- Last modified
- 2026-09-10
Weakness type
Related vulnerabilities
- CVE-2026-86770 — Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
- CVE-2026-82067 — Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup
- CVE-2021-48006 — PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity
- CVE-2026-84428 — fastify vulnerable to header validation bypass via incomplete schema case normalization
- CVE-2026-73476 — External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
- CVE-2026-84303 — gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
- CVE-2026-73270 — httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
- CVE-2026-83612 — xmldom: HTML raw-text closing-tag case mismatch causes output amplification