GHSA-7rvf-rqr3-43j4 (https://github.com/flatpak/flatpak/security/advisories/GHSA-7rvf-rqr3-43j4)

Description: When downloading apps or runtimes from an OCI repository that requires authentication, the OCI authentication token is written with the default permissions 0644. On multi-user systems this allows other local users to read the token file. This is related to GHSA-r9w3-qx54-qvc8 but with a different impact: unlike that issue, this one is not mitigated by a restrictive umask. libostree repositories such as Flathub are not affected; this only applies to apps, runtimes, or extensions downloaded from an OCI repository (such as those used by Fedora).

Mitigation: No known mitigation other than updating, or using libostree repositories (e.g. Flathub) or unauthenticated/public OCI repositories instead. Patched in 1.18.4 by commit f911bbf0 ("oci: Stop persisting bearer token to child repo on disk"). Credit: Found by AISLE in cooperation with Red Hat.