High

Incorrect Authorization in PortProtonQt Polkit Rule

IdentifiersCVE-2026-59678CWE-863· Incorrect Authorization

CVE-2026-59678 is a local incorrect authorization vulnerability in Linux-Gaming PortProtonQt caused by an insecure custom Polkit rule used to authorize privileged NetworkManager and UDisks2 actions. In affected versions, including PortProtonQt 1.3.0 and reportedly since 0.1.12, the rule attempts to determine whether a request originates from the trusted PortProtonQt helper by inspecting the requesting process and parent process command lines through the ps utility. This authorization design is flawed because command-line based process identification can be spoofed and is also subject to race conditions involving PID reuse or process replacement before the Polkit rule executes. As a result, arbitrary local users can satisfy the rule’s trust check and receive authorization for privileged actions that should be restricted. Successful exploitation allows unauthorized modification of NetworkManager system connections and unauthorized mounting or unmounting of file systems through UDisks2.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation gives an unprivileged local user unauthorized access to privileged system-management operations. An attacker can create or remove NetworkManager system connections, altering host network configuration and degrading system integrity or availability. The attacker can also mount arbitrary block devices under the locations permitted by UDisks2 and unmount other file systems when they are not in use, enabling denial of service, disruption of storage availability, and unauthorized manipulation of mounted media. Available information characterizes the practical impact primarily as integrity compromise and denial of service rather than confirmed full root code execution.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrade is not possible, remove or disable the custom PortProtonQt Polkit rule that grants elevated NetworkManager and UDisks2 permissions, or restrict it so that only explicitly authorized users in a dedicated local group can invoke the extra actions from an active local session. Avoid any authorization logic that trusts process names or command-line inspection for privileged decisions. Limiting local shell access to trusted users reduces exposure until the fixed policy is deployed.

Remediation

Patch, then assume compromise.

Upgrade PortProtonQt to a fixed release, specifically version 1.3.1 or later, or otherwise deploy the upstream fix that replaces the vulnerable authorization logic. The fix changes the Polkit policy so that the additional privileged actions are restricted to users in an active local session who are members of a dedicated PortProtonQt group, rather than relying on process command-line inspection. Systems running revisions prior to the fixed commit should be considered vulnerable.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

security opensuseNews

Jul 22, 2026

PortProtonQt: Custom Polkit Rule Allows Escalation of NetworkManager and UDisks2 Privileges (CVE-2026-59678) | SUSE Security Team Blog

An incidental CVE identifier mentioned in the timeline that appears inconsistent with the report's stated assigned CVE and is not otherwise described in the content.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3