Auth bypass in Tübitak Bilgem Software Technologies Research Institute Pardus About

CVE-2026-87772

Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privilege Escalation.

This issue affects Pardus About: before 1.2.5.

Vulnerability class: Broken Access Control

Published 2026-11-12 · last modified 2026-11-12.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

FIRST.org has not scored this CVE yet. About EPSS.

Affected products

Tübitak Bilgem Software Technologies Research Institute Pardus About

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

Public exploits and proof-of-concept code

1 public repository with exploit or proof-of-concept code for this CVE:

jankesec/CVE-2026-87772-pardus-about-lpe (last pushed 2026-11-12): Local privilege escalation PoC for CVE-2026-87772 (Pardus About): passwordless Polkit action + root mount without nosuid. Reproduced on 1.2.4; fixed in 1.2.5.

References

siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1521 (government-resource)

This CVE has public exploit evidence. See the latest CVEs with public exploits.