Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-61897

accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Canonical accountsservice

Default version status: unaffected

  • 22.07.5-2ubuntu1 to < 22.07.5-2ubuntu1.6affected
  • 23.13.9-2ubuntu6 to < 23.13.9-2ubuntu6.1affected
  • 23.13.9-8ubuntu5 to < 23.13.9-8ubuntu5.2affected
  • 23.13.9-8ubuntu6 to < 23.13.9-8ubuntu7affected

References