Bug 2569224

Summary: CVE-2026-114418 phodav: Authentication bypass in PUT request handling via libsoup3 status override [fedora-all]
Product: [Fedora] Fedora Reporter: Mauro Matteo Cascella <mcascell>
Component: phodavAssignee: Marc-Andre Lureau <marcandre.lureau>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: cfergeau, marcandre.lureau
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["4e258b72-1548-499d-9ca3-f860f039a9f3"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-11-10 05:27:54 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2558281    

Description Mauro Matteo Cascella 2026-11-09 18:00:42 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

An authentication bypass vulnerability was found in libphodav's PUT request handling. The streaming PUT handler in got_headers() processes requests even after libsoup3 has already rejected the message due to authentication failure for a path covered by a SoupAuthDomain. phodav ignores the rejection status and processes the PUT anyway, overwriting the response status. As a result, an unauthenticated client can create or overwrite files within the shared directory even when authentication is configured via htdigest. This issue was introduced by the libsoup3 port (commit c5879e6a, 2022-06-29) and affects phodav 3.0.
Comment 1 Marc-Andre Lureau 2026-11-10 05:27:54 UTC 
https://bodhi.fedoraproject.org/updates/FEDORA-2026-5d45844e71