Canonical authd CVE-2026-6970

Exploitation requires local access as a low-privileged authd-managed user (PR:L, AV:L) and a specific pre-existing state: the user's primary GID must differ from their UID, which happens only if the account was created with authd prior to 0.5.4 or its primary group was manually changed via 'authctl group set-gid'. Additionally, some user information in the identity provider must change so that authd updates the user record on next login - without an IdP record change, the erroneous reset is never triggered (this is the AT:P attack requirement). Limiting factors: default-configured accounts created on authd >= 0.5.4 (UID==GID) are not affected, the reset only fires at the affected user's next login after an IdP update, and impact depends on other local users mapping to the incorrectly-assigned GID, so this is not remote or unauthenticated.

Signals are consistent and point to a genuine but constrained integrity/DoS issue rather than an internet-facing emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N, base 7.3) requires local access with low privileges plus a specific attack requirement (AT:P), reflecting that exploitation depends on a pre-existing GID≠UID condition and an identity-provider record change - not something an attacker triggers at will. Technical impact is rated total (VC:H/VI:H/VA:H) because misowned files can cross user boundaries, yet EPSS is 0.01% (2nd percentile), SSVC Automatable is 'no', and SSVC Exploitation is 'none', so this is not a mass-exploitable target. POC/exploit code is public, but that is distinct from active exploitation, which is not confirmed. Net: prioritize for environments actually running authd with legacy or manually-reassigned GIDs; deprioritize elsewhere.

On a shared Ubuntu host using authd, a low-privileged local user whose account was provisioned under authd < 0.5.4 (UID≠GID) has an attribute updated in the identity provider; on their next login authd resets their primary GID to their UID. Files they subsequently create are stamped with the wrong group, and another local user who is a member of (or maps to) that GID can read or modify data they should not, enabling information disclosure or privilege escalation. Public POC/exploit code exists (referenced gist), lowering the practical barrier for a local actor.