CVE-2026-87876

Two case-insensitive comparisons on request-derived usernames remain in the CUPS scheduler outside the main authorization path, in the printer ACL validation logic (check_quotas() in scheduler/ipp.c) and the private-attribute filtering logic (cupsdGetPrivateAttrs() in scheduler/policy.c), and were not addressed by the fix for CVE-2026-27447. In certain configurations, an authenticated attacker on the adjacent network could use these comparisons to bypass username-based access controls and access information protected by those controls, resulting in a limited loss of confidentiality with no impact on integrity or availability. Red Hat and upstream both rate this flaw LOW severity (CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N), as exploitation requires an adjacent-network position, an authenticated low-privilege account, and user interaction. The cups component in Red Hat Enterprise Linux, Red Hat OpenShift Container Platform (RHCOS), and Red Hat In-Vehicle OS is affected, with the fix deferred to a future update; given the low severity rating and the prerequisites for exploitation, the residual risk of deferring the fix is considered limited. Fedora and Red Hat Hardened Images are also affected: the Fedora fix is being pursued with the community, and a fix has already been delivered for Red Hat Hardened Images.