{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35207", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-01T18:48:58.937Z", "datePublished": "2026-04-09T17:48:07.637Z", "dateUpdated": "2026-04-13T20:13:07.926Z"}, "containers": {"cna": {"title": "deepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote server", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-jf2h-4vqc-3jgc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-jf2h-4vqc-3jgc"}, {"name": "https://github.com/linuxdeepin/dde-control-center/pull/3146", "tags": ["x_refsource_MISC"], "url": "https://github.com/linuxdeepin/dde-control-center/pull/3146"}, {"name": "https://github.com/linuxdeepin/dde-control-center/commit/6fc206120be28d9eef7d72258662bcabb834367f", "tags": ["x_refsource_MISC"], "url": "https://github.com/linuxdeepin/dde-control-center/commit/6fc206120be28d9eef7d72258662bcabb834367f"}, {"name": "https://github.com/linuxdeepin/dde-control-center/commit/cd95b054ff10a35bc9284431631305bd56244b3d", "tags": ["x_refsource_MISC"], "url": "https://github.com/linuxdeepin/dde-control-center/commit/cd95b054ff10a35bc9284431631305bd56244b3d"}], "affected": [{"vendor": "linuxdeepin", "product": "dde-control-center", "versions": [{"version": ">= 6.1.35, < 6.1.80", "status": "affected"}, {"version": ">= 5.5.3, < 5.9.9", "status": "affected"}]}, {"vendor": "linuxdeepin", "product": "deepin-deepinid-plugin", "versions": [{"version": ">= 2.0.1, <= 2.0.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T17:48:07.637Z"}, "descriptions": [{"lang": "en", "value": "dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to 6.1.80, plugin-deepinid is configured to skip TLS certificate verification when fetching the user's avatar from openapi.deepin.com or other providers. An MITM attacker could intercept the traffic, replace the avatar with a malicious or misleading image, and potentially identify the user by the avatar. This vulnerability is fixed in dde-control-center 6.1.80 and 5.9.9."}], "source": {"advisory": "GHSA-jf2h-4vqc-3jgc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T20:12:58.232383Z", "id": "CVE-2026-35207", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T20:13:07.926Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35207", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T20:12:58.232383Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T20:13:03.728Z"}}], "cna": {"title": "deepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote server", "source": {"advisory": "GHSA-jf2h-4vqc-3jgc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "linuxdeepin", "product": "dde-control-center", "versions": [{"status": "affected", "version": ">= 6.1.35, < 6.1.80"}, {"status": "affected", "version": ">= 5.5.3, < 5.9.9"}]}, {"vendor": "linuxdeepin", "product": "deepin-deepinid-plugin", "versions": [{"status": "affected", "version": ">= 2.0.1, <= 2.0.9"}]}], "references": [{"url": "https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-jf2h-4vqc-3jgc", "name": "https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-jf2h-4vqc-3jgc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/linuxdeepin/dde-control-center/pull/3146", "name": "https://github.com/linuxdeepin/dde-control-center/pull/3146", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/linuxdeepin/dde-control-center/commit/6fc206120be28d9eef7d72258662bcabb834367f", "name": "https://github.com/linuxdeepin/dde-control-center/commit/6fc206120be28d9eef7d72258662bcabb834367f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/linuxdeepin/dde-control-center/commit/cd95b054ff10a35bc9284431631305bd56244b3d", "name": "https://github.com/linuxdeepin/dde-control-center/commit/cd95b054ff10a35bc9284431631305bd56244b3d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to 6.1.80, plugin-deepinid is configured to skip TLS certificate verification when fetching the user's avatar from openapi.deepin.com or other providers. An MITM attacker could intercept the traffic, replace the avatar with a malicious or misleading image, and potentially identify the user by the avatar. This vulnerability is fixed in dde-control-center 6.1.80 and 5.9.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T17:48:07.637Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35207", "state": "PUBLISHED", "dateUpdated": "2026-04-13T20:13:07.926Z", "dateReserved": "2026-04-01T18:48:58.937Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-09T17:48:07.637Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to 6.1.80, plugin-deepinid is configured to skip TLS certificate verification when fetching the user's avatar from openapi.deepin.com or other providers. An MITM attacker could intercept the traffic, replace the avatar with a malicious or misleading image, and potentially identify the user by the avatar. This vulnerability is fixed in dde-control-center 6.1.80 and 5.9.9."}], "id": "CVE-2026-35207", "lastModified": "2026-04-13T15:02:27.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-09T18:17:01.110", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/linuxdeepin/dde-control-center/commit/6fc206120be28d9eef7d72258662bcabb834367f"}, {"source": "security-advisories@github.com", "url": "https://github.com/linuxdeepin/dde-control-center/commit/cd95b054ff10a35bc9284431631305bd56244b3d"}, {"source": "security-advisories@github.com", "url": "https://github.com/linuxdeepin/dde-control-center/pull/3146"}, {"source": "security-advisories@github.com", "url": "https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-jf2h-4vqc-3jgc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.35,6.1.80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.5.3,5.9.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dde-control-center", "source": "cna", "vendor": "linuxdeepin"}, "product": "dde-control-center", "vendor": "linuxdeepin"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.1,2.0.9]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "deepin-deepinid-plugin", "source": "cna", "vendor": "linuxdeepin"}, "product": "deepin-deepinid-plugin", "vendor": "linuxdeepin"}], "analysis": {"en": {"generated_at": "2026-04-09T20:24:29.197032+00:00", "value": {"mitigation_remediation": ["Upgrade dde-control-center to version 6.1.80 or later", "Upgrade deepin-deepinid-plugin to version 5.9.9 or later", "If an upgrade cannot be applied immediately, disable the plugin or enforce TLS verification when retrieving avatars"], "summary": {"action": "Apply Patch", "impact": "User impersonation via tampered avatar"}, "threat_synthesis": {"affected_systems": "The affected components are Deepin Desktop Environment\u2019s control panel (dde-control-center) and the deepin-deepinid-plugin. Versions before 6.1.80 of dde-control-center and before 5.9.9 of the plugin contain the flaw.", "description_and_impact": "A plugin in Deepin Control Center was set to bypass TLS certificate verification when downloading a user\u2019s avatar from online services, a certificate verification bypass weakness identified as CWE\u2011295. This flaw allows an attacker who can position themselves between the local machine and the avatar\u2011providing server to intercept the request and supply a malicious or misleading image, potentially misidentifying the user or delivering deceptive content.", "risk_and_exploitability": "The CVSS score of 5.4 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be on a network path between the user\u2019s machine and the avatar service, which is feasible on compromised or poorly secured networks. Once the TLS check is bypassed, the attacker can alter the avatar without detection, enabling user impersonation or deceptive imagery."}}}}, "created": "2026-04-10T08:52:41.431383+00:00", "updated": "2026-04-10T09:31:51.291491+00:00", "vendors": ["linuxdeepin", "linuxdeepin$PRODUCT$dde-control-center", "linuxdeepin$PRODUCT$deepin-deepinid-plugin"]}