Read the docs
TI-2026-44286 Aliases CVE-2026-61897GHSA-8h74-384h-cv6c

accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts

Priority LOW 35CWE-273Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0014 3rd percentileScored 2026-11-07
Fix Fixed accountsservice (Canonical): 22.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1, 23.13.9-8ubuntu5.2 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicalaccountsservice22.07.5-2ubuntu1 to before 22.07.5-2ubuntu1.6; 23.13.9-2ubuntu6 to before 23.13.9-2ubuntu6.1; 23.13.9-8ubuntu5 to before 23.13.9-8ubuntu5.2; 23.13.9-8ubuntu6 to before 23.13.9-8ubuntu722.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1, 23.13.9-8ubuntu5.2, 23.13.9-8ubuntu7Patch availableCNA
  • accountsservice VendorCanonical Affected 22.07.5-2ubuntu1 to before 22.07.5-2ubuntu1.6; 23.13.9-2ubuntu6 to before 23.13.9-2ubuntu6.1; 23.13.9-8ubuntu5 to before 23.13.9-8ubuntu5.2; 23.13.9-8ubuntu6 to before 23.13.9-8ubuntu7 Fixed in 22.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1, 23.13.9-8ubuntu5.2, 23.13.9-8ubuntu7 Patch available CNA

Remediation

  • Fix · CNA accountsservice (Canonical) Fixed in 22.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1, 23.13.9-8ubuntu5.2, 23.13.9-8ubuntu7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Canonical accountsservice 22.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1 and 2 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-44287 accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scriptsPriority LOW 35
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61897
  2. 2026-10-03 Alias added: GHSA-8h74-384h-cv6c

References

Advisory 1

Other 1

  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
See all 4301 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences