Skip to main content

Ubuntu AccountsService CVE-2026-61897

| EUVDEUVD-2026-63379 HIGH
Improper Check for Dropped Privileges (CWE-273)
2026-08-20 canonical GHSA-8h74-384h-cv6c
Privilege Escalation Ubuntu Accountsservice Red Hat Suse
7.8
CVSS 3.1 · Vendor: canonical
Share

Severity by source

Vendor (canonical) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local vector and PR:L because any authenticated local user can trigger the D-Bus call; full CIA impact from achieving root on the local system.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (canonical).

CVSS VectorVendor: canonical

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch available
Aug 20, 2026 - 15:16 EUVD
Analysis Generated
Aug 20, 2026 - 15:07 vuln.today
CVE Published
Aug 20, 2026 - 14:32 cve.org
HIGH 7.8

DescriptionCVE.org

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

AnalysisAI

Local privilege escalation in Ubuntu's AccountsService (before 23.13.9-8ubuntu7) lets any low-privileged local user gain full root access by exploiting an incomplete privilege-drop in a Canonical-specific patch. The patch sets the effective UID/GID to the target user before launching language helper scripts but neglects to change the real UID, leaving ruid=0. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid local user account on an Ubuntu system running AccountsService before 23.13.9-8ubuntu7; the CVSS vector (PR:L) confirms low-privileged authenticated access is sufficient. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated to the actual threat: local access with a standard user account, low complexity exploitation, and full CIA impact from achieving root. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary fix is upgrading Ubuntu's AccountsService package to version 23.13.9-8ubuntu7 or later via `sudo apt update && sudo apt upgrade accountsservice`, as documented in Canonical's advisory at https://ubuntu.com/security/CVE-2026-61897. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all Ubuntu systems, identify which versions of AccountsService are deployed (check against 23.13.9-8ubuntu7), and prioritize high-risk systems hosting sensitive data or supporting multi-user access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Accountsservice

View all
CVE-2023-3297 HIGH POC
7.8 Sep 01

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice
CVE-2018-14036 MEDIUM POC
6.5 Jul 13

Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in

CVE-2020-16127 MEDIUM POC
5.5 Nov 11

An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions,

CVE-2026-61898 HIGH
7.8 Aug 20

Privilege escalation in Ubuntu's accountsservice package allows a local low-privileged user to execute arbitrary shell c
CVE-2021-3939 HIGH
7.8 Nov 17

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallb
CVE-2020-16126 LOW POC
3.3 Nov 11

An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions,

CVE-2012-2737 LOW POC
1.9 Jul 22

The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does n
CVE-2022-1804 MEDIUM
5.5 Mar 25

accountsservice no longer drops permissions when writting .pam_environment. Rated medium severity (CVSS 5.5), this vulne

Same weakness CWE-273 – Improper Check for Dropped Privileges

View all
CVE-2017-6972 CRITICAL POC
9.8
CVE-2023-34844 CRITICAL POC
9.8
CVE-2019-18276 HIGH POC
7.8
CVE-2024-25420 HIGH POC
7.2
CVE-2015-0278 CRITICAL
10.0
CVE-2021-36372 CRITICAL
9.8
CVE-2020-24361 CRITICAL
9.8
CVE-2025-27396 HIGH
8.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server 16.0 Not-Affected
SUSE Linux Enterprise Server 16.1 Not-Affected

Share

CVE-2026-61897 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy