CVE-2026-1933 — Improper Access Control in Samba

Vendor	Product	Version range	Fixed in
redhat	enterprise_linux	—	—
redhat	enterprise_linux	—	—
redhat	enterprise_linux	—	—
redhat	enterprise_linux	—	—
redhat	openshift_container_platform	—	—
samba	samba	—	—
samba	samba	>= 4.1.0 < 4.2.2	4.2.2
ubuntu	samba	—	—

Red Hat

samba: Missing access check on reparse point operations

vendor_redhat·2026-05-27·CVSS 7.1

CVE-2026-1933 [HIGH] CWE-284 samba: Missing access check on reparse point operations samba: Missing access check on reparse point operations A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types. Statement: This vulnerability is rated Important severity by Red Hat Product Security, because authenticated users with filesystem-level write permissions may bypass Samba’s SMB-layer read-only protections for reparse point operations. The flaw affects shares configured with "read only = yes", wh

Red Hat

jenkins-email-extension-plugin: Jenkins Email Extension Plugin: Information disclosure via arbitrary file read

vendor_redhat·2026-05-27·CVSS 8.8

CVE-2026-48920 [HIGH] CWE-22 jenkins-email-extension-plugin: Jenkins Email Extension Plugin: Information disclosure via arbitrary file read jenkins-email-extension-plugin: Jenkins Email Extension Plugin: Information disclosure via arbitrary file read Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem. A flaw was found in the Jenkins Email Extension Plugin. An attacker with the ability to control email content can exploit this vulnerability by inlining images with `file:` URLs. This allows the attacker to read arbitrary files from the Jenkins controller filesystem, leading to information disclosure. Package: jenkins-

Ubuntu

Samba vulnerabilities

vendor_ubuntu·2026-05-26·CVSS 8.5

CVE-2026-4480 [HIGH] Samba vulnerabilities Title: Samba vulnerabilities Summary: Several security issues were fixed in Samba. Asim Viladi Oglu Manizada discovered that Samba incorrectly handled access checks on reparse point operations. An attacker could possibly use this issue to modify reparse point extended attributes on files that should have been read-only. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-1933) Pavel Kohout discovered that Samba's vfs_worm module did not properly block file overwrites. An attacker could possibly use this issue to overwrite files that should have remained immutable. (CVE-2026-2340) Arad Inbar, Nir Somech, and Ben Grinberg discovered that Samba incorrectly handled certificate auto-enrolment group policies over HTTP without verification. A machine-in-the-middle attacker c

VulDB

Samba NTFS access control (Nessus ID 316851)

vuldb·2026-06-07·CVSS 6.5

CVE-2026-1933 [MEDIUM] Samba NTFS access control (Nessus ID 316851) A vulnerability marked as critical has been reported in Samba. Affected is an unknown function of the component NTFS Handler. The manipulation leads to improper access controls. This vulnerability is uniquely identified as CVE-2026-1933. The attack is possible to be carried out remotely. No exploit exists.

GHSA

GHSA-c866-5hw6-cqf9: A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes

ghsa_unreviewed·2026-05-27

CVE-2026-1933 [HIGH] CWE-284 GHSA-c866-5hw6-cqf9: A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.

GHSA

Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem

ghsa·2026-05-27

CVE-2026-48920 [HIGH] CWE-73 Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem Jenkins Email Extension Plugin 1933.v45cec755423f and earlier includes a feature that allows inlining images as `base64` in email content by setting the `data-inline` attribute. No restrictions are placed on the image URLs that can be inlined. This allows attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem. The feature allowing inlining images as `base64` in email content by setting the `data-inline` attribute is removed from Email Extension Plugin 1933.1935.v276319e3cc47.

CVE-2026-1933: A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks…

Affected

CVSS provenance