CVE-2026-35207

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35207", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-01T18:48:58.937Z", "datePublished": "2026-04-09T17:48:07.637Z", "dateUpdated": "2026-04-13T20:13:07.926Z"}, "containers": {"cna": {"title": "deepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote server", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-jf2h-4vqc-3jgc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-jf2h-4vqc-3jgc"}, {"name": "https://github.com/linuxdeepin/dde-control-center/pull/3146", "tags": ["x_refsource_MISC"], "url": "https://github.com/linuxdeepin/dde-control-center/pull/3146"}, {"name": "https://github.com/linuxdeepin/dde-control-center/commit/6fc206120be28d9eef7d72258662bcabb834367f", "tags": ["x_refsource_MISC"], "url": "https://github.com/linuxdeepin/dde-control-center/commit/6fc206120be28d9eef7d72258662bcabb834367f"}, {"name": "https://github.com/linuxdeepin/dde-control-center/commit/cd95b054ff10a35bc9284431631305bd56244b3d", "tags": ["x_refsource_MISC"], "url": "https://github.com/linuxdeepin/dde-control-center/commit/cd95b054ff10a35bc9284431631305bd56244b3d"}], "affected": [{"vendor": "linuxdeepin", "product": "dde-control-center", "versions": [{"version": ">= 6.1.35, < 6.1.80", "status": "affected"}, {"version": ">= 5.5.3, < 5.9.9", "status": "affected"}]}, {"vendor": "linuxdeepin", "product": "deepin-deepinid-plugin", "versions": [{"version": ">= 2.0.1, <= 2.0.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T17:48:07.637Z"}, "descriptions": [{"lang": "en", "value": "dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to 6.1.80, plugin-deepinid is configured to skip TLS certificate verification when fetching the user's avatar from openapi.deepin.com or other providers. An MITM attacker could intercept the traffic, replace the avatar with a malicious or misleading image, and potentially identify the user by the avatar. This vulnerability is fixed in dde-control-center 6.1.80 and 5.9.9."}], "source": {"advisory": "GHSA-jf2h-4vqc-3jgc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T20:12:58.232383Z", "id": "CVE-2026-35207", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T20:13:07.926Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35207", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T20:12:58.232383Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T20:13:03.728Z"}}], "cna": {"title": "deepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote server", "source": {"advisory": "GHSA-jf2h-4vqc-3jgc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "linuxdeepin", "product": "dde-control-center", "versions": [{"status": "affected", "version": ">= 6.1.35, < 6.1.80"}, {"status": "affected", "version": ">= 5.5.3, < 5.9.9"}]}, {"vendor": "linuxdeepin", "product": "deepin-deepinid-plugin", "versions": [{"status": "affected", "version": ">= 2.0.1, <= 2.0.9"}]}], "references": [{"url": "https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-jf2h-4vqc-3jgc", "name": "https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-jf2h-4vqc-3jgc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/linuxdeepin/dde-control-center/pull/3146", "name": "https://github.com/linuxdeepin/dde-control-center/pull/3146", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/linuxdeepin/dde-control-center/commit/6fc206120be28d9eef7d72258662bcabb834367f", "name": "https://github.com/linuxdeepin/dde-control-center/commit/6fc206120be28d9eef7d72258662bcabb834367f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/linuxdeepin/dde-control-center/commit/cd95b054ff10a35bc9284431631305bd56244b3d", "name": "https://github.com/linuxdeepin/dde-control-center/commit/cd95b054ff10a35bc9284431631305bd56244b3d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to 6.1.80, plugin-deepinid is configured to skip TLS certificate verification when fetching the user's avatar from openapi.deepin.com or other providers. An MITM attacker could intercept the traffic, replace the avatar with a malicious or misleading image, and potentially identify the user by the avatar. This vulnerability is fixed in dde-control-center 6.1.80 and 5.9.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T17:48:07.637Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35207", "state": "PUBLISHED", "dateUpdated": "2026-04-13T20:13:07.926Z", "dateReserved": "2026-04-01T18:48:58.937Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-09T17:48:07.637Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dde-control-center", "vendor": "linuxdeepin", "versions": [{"status": "affected", "version": ">= 6.1.35, < 6.1.80"}, {"status": "affected", "version": ">= 5.5.3, < 5.9.9"}]}, {"product": "deepin-deepinid-plugin", "vendor": "linuxdeepin", "versions": [{"status": "affected", "version": ">= 2.0.1, <= 2.0.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to 6.1.80, plugin-deepinid is configured to skip TLS certificate verification when fetching the user's avatar from openapi.deepin.com or other providers. An MITM attacker could intercept the traffic, replace the avatar with a malicious or misleading image, and potentially identify the user by the avatar. This vulnerability is fixed in dde-control-center 6.1.80 and 5.9.9."}, {"lang": "es", "value": "dde-control-center es el panel de control de DDE, el Entorno de Escritorio Deepin. plugin-deepinid es un plugin en dde-control-center, que proporciona el servicio en la nube deepinid. Antes de la versi\u00f3n 6.1.80, plugin-deepinid est\u00e1 configurado para omitir la verificaci\u00f3n del certificado TLS al obtener el avatar del usuario de openapi.deepin.com u otros proveedores. Un atacante MitM podr\u00eda interceptar el tr\u00e1fico, reemplazar el avatar con una imagen maliciosa o enga\u00f1osa, y potencialmente identificar al usuario por el avatar. Esta vulnerabilidad est\u00e1 corregida en dde-control-center 6.1.80 y 5.9.9."}], "id": "CVE-2026-35207", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35207", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T20:12:58.232383Z", "version": "2.0.3"}}]}, "published": "2026-04-09T18:17:01.110", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/linuxdeepin/dde-control-center/commit/6fc206120be28d9eef7d72258662bcabb834367f"}, {"source": "security-advisories@github.com", "url": "https://github.com/linuxdeepin/dde-control-center/commit/cd95b054ff10a35bc9284431631305bd56244b3d"}, {"source": "security-advisories@github.com", "url": "https://github.com/linuxdeepin/dde-control-center/pull/3146"}, {"source": "security-advisories@github.com", "url": "https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-jf2h-4vqc-3jgc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.35,6.1.80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.5.3,5.9.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dde-control-center", "source": "cna", "vendor": "linuxdeepin"}, "product": "dde-control-center", "vendor": "linuxdeepin"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.1,2.0.9]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "deepin-deepinid-plugin", "source": "cna", "vendor": "linuxdeepin"}, "product": "deepin-deepinid-plugin", "vendor": "linuxdeepin"}], "analysis": {"en": {"generated_at": "2026-04-09T20:24:29.197032+00:00", "value": {"mitigation_remediation": ["Upgrade dde-control-center to version 6.1.80 or later", "Upgrade deepin-deepinid-plugin to version 5.9.9 or later", "If an upgrade cannot be applied immediately, disable the plugin or enforce TLS verification when retrieving avatars"], "summary": {"action": "Apply Patch", "impact": "User impersonation via tampered avatar"}, "threat_synthesis": {"affected_systems": "The affected components are Deepin Desktop Environment\u2019s control panel (dde-control-center) and the deepin-deepinid-plugin. Versions before 6.1.80 of dde-control-center and before 5.9.9 of the plugin contain the flaw.", "description_and_impact": "A plugin in Deepin Control Center was set to bypass TLS certificate verification when downloading a user\u2019s avatar from online services, a certificate verification bypass weakness identified as CWE\u2011295. This flaw allows an attacker who can position themselves between the local machine and the avatar\u2011providing server to intercept the request and supply a malicious or misleading image, potentially misidentifying the user or delivering deceptive content.", "risk_and_exploitability": "The CVSS score of 5.4 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be on a network path between the user\u2019s machine and the avatar service, which is feasible on compromised or poorly secured networks. Once the TLS check is bypassed, the attacker can alter the avatar without detection, enabling user impersonation or deceptive imagery."}}}}, "created": "2026-04-10T08:52:41.431383+00:00", "updated": "2026-04-10T09:31:51.291491+00:00", "vendors": ["linuxdeepin", "linuxdeepin$PRODUCT$dde-control-center", "linuxdeepin$PRODUCT$deepin-deepinid-plugin"]}