Backport of:

From a0c62c1e69604ff061089b750073199fab5a1beb Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Tue, 31 Mar 2026 14:04:21 -0400
Subject: [PATCH] CVE-2026-27447: The scheduler treated local user and group
 names as case-insensitive.

---
 CHANGES.md       |  2 ++
 scheduler/auth.c | 31 +++++++++++++++----------------
 2 files changed, 17 insertions(+), 16 deletions(-)

#diff --git a/CHANGES.md b/CHANGES.md
#index 4209cfed9..fa6e32ee2 100644
#--- a/CHANGES.md
#+++ b/CHANGES.md
#@@ -5,6 +5,8 @@ CHANGES - OpenPrinting CUPS
# Changes in CUPS v2.4.17 (YYYY-MM-DD)
# ------------------------------------
# 
#+- CVE-2026-27447: The scheduler treated local user and group names as case-
#+  insensitive.
# - The scheduler followed symbolic links when cleaning out its temporary
#   directory (Issue #1448)
# - Updated `cupsFileGetConf` and `cupsFilePutConf` to escape more characters.
--- a/scheduler/auth.c
+++ b/scheduler/auth.c
@@ -1184,7 +1184,7 @@ cupsdCheckGroup(
   group = getgrnam(groupname);
   endgrent();
 
-  if (group != NULL)
+  if (user && group)
   {
    /*
     * Group exists, check it...
@@ -1198,7 +1198,7 @@ cupsdCheckGroup(
       * User appears in the group membership...
       */
 
-      if (!_cups_strcasecmp(username, group->gr_mem[i]))
+      if (!strcmp(user->pw_name, group->gr_mem[i]))
 	return (1);
     }
 
@@ -1209,25 +1209,24 @@ cupsdCheckGroup(
     * belongs to...
     */
 
-    if (user)
-    {
-      int	ngroups;		/* Number of groups */
+    int		ngroups;		/* Number of groups */
 #  ifdef __APPLE__
-      int	groups[2048];		/* Groups that user belongs to */
+    int		groups[2048];		/* Groups that user belongs to */
 #  else
-      gid_t	groups[2048];		/* Groups that user belongs to */
+    gid_t	groups[2048];		/* Groups that user belongs to */
 #  endif /* __APPLE__ */
 
-      ngroups = (int)(sizeof(groups) / sizeof(groups[0]));
+    ngroups = (int)(sizeof(groups) / sizeof(groups[0]));
 #  ifdef __APPLE__
-      getgrouplist(username, (int)user->pw_gid, groups, &ngroups);
+    getgrouplist(user->pw_name, (int)user->pw_gid, groups, &ngroups);
 #  else
-      getgrouplist(username, user->pw_gid, groups, &ngroups);
+    getgrouplist(user->pw_name, user->pw_gid, groups, &ngroups);
 #endif /* __APPLE__ */
 
-      for (i = 0; i < ngroups; i ++)
-        if ((int)groupid == (int)groups[i])
-	  return (1);
+    for (i = 0; i < ngroups; i ++)
+    {
+      if ((int)groupid == (int)groups[i])
+	return (1);
     }
 #endif /* HAVE_GETGROUPLIST */
   }
@@ -1837,7 +1836,7 @@ cupsdIsAuthorized(cupsd_client_t *con,	/
 	 name = (char *)cupsArrayNext(best->names))
     {
       if (!_cups_strcasecmp(name, "@OWNER") && owner &&
-          !_cups_strcasecmp(username, ownername))
+          !strcmp(pw->pw_name, ownername))
 	return (HTTP_OK);
       else if (!_cups_strcasecmp(name, "@SYSTEM"))
       {
@@ -1849,7 +1848,7 @@ cupsdIsAuthorized(cupsd_client_t *con,	/
         if (cupsdCheckGroup(username, pw, name + 1))
           return (HTTP_OK);
       }
-      else if (!_cups_strcasecmp(username, name))
+      else if (pw && !strcmp(pw->pw_name, name))
         return (HTTP_OK);
     }
 
