EUVD-2026-25871
GHSA-fg3j-5w9g-hmg7
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local, low-priv user (AV:L/PR:L); AC:H because it needs a pre-existing GID≠UID account plus an IdP-triggered record update; high C/I/A from cross-user file mis-ownership; scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID (GID) differs from their UID, either because the account was created with authd prior to version 0.5.4 or because the primary group was manually changed via the authctl group set-gid command, and the user's identity provider record is updated, authd incorrectly resets the user's primary group ID to their UID upon next login. This causes newly created files and directories to be owned by the wrong group, causing denial of service issues, and potentially granting unintended access to other local users and allowing local privilege escalation.
AnalysisAI
Local privilege escalation in Canonical's authd (the Ubuntu authentication daemon for external identity providers) prior to 0.6.4 arises from a logic error that resets a user's primary group ID (GID) to their UID when their identity-provider record changes. Affected are users whose primary GID legitimately differs from their UID - created under authd < 0.5.4 or reassigned via 'authctl group set-gid' - causing newly created files and directories to be misowned by an unintended group. Publicly available exploit code exists, but there is no public exploit identified as actively used; SSVC records exploitation status as none and EPSS is negligible (0.01%).
Technical ContextAI
authd is Canonical's daemon that lets Ubuntu authenticate local logins against cloud identity providers (e.g. Microsoft Entra ID / OIDC brokers), provisioning per-user private groups via NSS. The flaw is CWE-842 (placement of a resource into the wrong sphere / incorrect group assignment): in internal/users/manager.go the UpdateUser function unconditionally set the user's private-group GID equal to the UID (userPrivateGroup.GID = &u.UID) on every update, discarding any custom GID previously stored. The CPE cpe:2.3:a:canonical:authd confirms the single affected package. The 0.6.4 fix reworks the loop so the private group's GID defaults to the UID only on first login (when the group does not yet exist) and otherwise preserves the existing stored GID across subsequent logins.
RemediationAI
Vendor-released patch: upgrade to authd 0.6.4 (Ubuntu users update to 0.6.1ubuntu0.1 or later), which preserves custom private-group GIDs across logins; see https://github.com/canonical/authd/security/advisories/GHSA-fg3j-5w9g-hmg7 and the fix commit https://github.com/canonical/authd/commit/154b428305cb1a7a19c897626fefd09d6dde8b9f. Patching alone does not repair accounts already corrupted, so run the vendor-provided remediation script, which for each authd user restores the correct GID via two 'authctl group set-gid' calls and recursively re-owns home-directory files with 'chown -R --from=:OLD_GID :GID'; affected users must then log out and back in (optionally force-terminate sessions with 'loginctl terminate-user') for id/groups and new-file GID stamping to reflect the fix. Files owned by the incorrect GID outside the home directory must be re-owned manually. As an interim compensating control before patching, avoid changing identity-provider records for affected accounts (which is what triggers the reset) and audit/tighten permissions on world- or group-readable directories to limit cross-user exposure - with the trade-off that IdP attribute changes cannot be deferred indefinitely.
Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. Rated medium severity (CVSS
Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same b
Privilege escalation flaw in authd's temporary user record handling during pre-authentication NSS operations that causes
authd sets weak permissions for /etc/ident.key, which allows local users to obtain the key by leveraging a race conditio
Same weakness CWE-842 – Placement of User into Incorrect Group
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today