{"cve":"CVE-2019-3827","nvd":{"published":"2019-03-25T18:29:00.887","modified":"2026-06-17T02:35:40.360","status":"Modified","description":"An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.0},"cwes":["CWE-863"],"references":["https://access.redhat.com/errata/RHSA-2019:1517","https://access.redhat.com/errata/RHSA-2019:2145","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3827","https://gitlab.gnome.org/GNOME/gvfs/merge_requests/31","https://access.redhat.com/errata/RHSA-2019:1517"],"products":["gnome:gvfs"],"source":"nvd","synced_at":"2026-10-19T20:55:22.313337056+00:00"},"epss":{"cve":"CVE-2019-3827","score":0.00364,"percentile":0.30235,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}