Skip to content
Sign in
7.8 High

CVE-2026-61897 An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching…

Description

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

Affected products and versions

Product Affected versions Fixed in
accountsservice 23.13 23.13.9-2ubuntu6 → < 23.13.9-8ubuntu7 23.13.9-2ubuntu6.1
accountsservice 22.07 22.07.5-2ubuntu1 → < 22.07.5-2ubuntu1.6 22.07.5-2ubuntu1.6

Other CVEs of accountsservice

The 2 CVEs of accountsservice →
CVE-2026-61898 The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before… 7.8 High
Track this CVE