Missing authorization (polkit) vulnerability in the org.freedesktop.UDisks2.Encrypted.HeaderBackup D-Bus method of udisks. The flaw is caused by the absence of a call to udisks_daemon_util_check_authorization_sync() in the handle_header_backup() handler. An unprivileged local user can invoke this system-bus method to cause the root-owned udisks daemon to call bd_crypto_luks_header_backup() and export LUKS headers and keyslot metadata to an arbitrary file path. This allows unauthorized disclosure of sensitive cryptographic material without authentication or user interaction.