CVE-2023-43090: Gnome-shell: screenshot tool allows viewing open windows when session is locked

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-22 · updated 2026-06-17
Weakness: CWE-862

Description

A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.

Affected products

Fedoraproject Fedora: 37, 38
gnome-shell: from 43 before 43.9; from 44 before 44.5; 42 — fixed in 43.9, 44.5

How to fix

Upgrade to a fixed version: gnome-shell 43.9, 44.5. Check the vendor advisory for mitigations.

References

https://access.redhat.com/security/cve/CVE-2023-43090
https://bugzilla.redhat.com/show_bug.cgi?id=2239087
https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6990
https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/2944
https://access.redhat.com/security/cve/CVE-2023-43090
https://bugzilla.redhat.com/show_bug.cgi?id=2239087
https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6990
https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/2944

Get alerted when CVE-2023-43090 or the next vulnerability affects your stack