CVE-2023-32190: Suse Opensuse Tumbleweed

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges.

Affected products

• Suse Opensuse Tumbleweed: before 0.26-37.1 (fixed in 0.26-37.1)

Published 2024-10-16. Last modified 2026-06-17.