CVE-2026-61897

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-61897", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-07-11T18:43:51.251Z", "datePublished": "2026-08-20T14:32:53.827Z", "dateUpdated": "2026-08-26T19:50:49.398Z"}, "containers": {"cna": {"title": "accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts", "descriptions": [{"lang": "en", "value": "An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation."}], "affected": [{"vendor": "Canonical", "product": "accountsservice", "packageName": "accountsservice", "platforms": ["Ubuntu 14.04 LTS", "Ubuntu 16.04 LTS", "Ubuntu 18.04 LTS", "Ubuntu 20.04 LTS", "Ubuntu 22.04 LTS", "Ubuntu 24.04 LTS", "Ubuntu 26.04 LTS", "Ubuntu 26.10"], "versions": [{"version": "22.07.5-2ubuntu1", "status": "affected", "lessThan": "22.07.5-2ubuntu1.6", "versionType": "dpkg"}, {"version": "23.13.9-2ubuntu6", "status": "affected", "lessThan": "23.13.9-2ubuntu6.1", "versionType": "dpkg"}, {"version": "23.13.9-8ubuntu5", "status": "affected", "lessThan": "23.13.9-8ubuntu5.2", "versionType": "dpkg"}, {"version": "23.13.9-8ubuntu6", "status": "affected", "lessThan": "23.13.9-8ubuntu7", "versionType": "dpkg"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-273", "description": "CWE-273: Improper Check for Dropped Privileges"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985", "name": "Launchpad Bug #2157985", "tags": ["issue-tracking"]}, {"url": "https://ubuntu.com/security/CVE-2026-61897", "name": "Ubuntu CVE Tracker", "tags": ["vendor-advisory"]}], "credits": [{"lang": "en", "type": "finder", "value": "Deutsche Telekom Security GmbH Red Team"}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-08-20T14:32:53.827Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T19:43:37.600246Z", "id": "CVE-2026-61897", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T19:50:49.398Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-61897", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T19:43:37.600246Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T19:50:43.428Z"}}], "cna": {"title": "accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts", "credits": [{"lang": "en", "type": "finder", "value": "Deutsche Telekom Security GmbH Red Team"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Canonical", "product": "accountsservice", "versions": [{"status": "affected", "version": "22.07.5-2ubuntu1", "lessThan": "22.07.5-2ubuntu1.6", "versionType": "dpkg"}, {"status": "affected", "version": "23.13.9-2ubuntu6", "lessThan": "23.13.9-2ubuntu6.1", "versionType": "dpkg"}, {"status": "affected", "version": "23.13.9-8ubuntu5", "lessThan": "23.13.9-8ubuntu5.2", "versionType": "dpkg"}, {"status": "affected", "version": "23.13.9-8ubuntu6", "lessThan": "23.13.9-8ubuntu7", "versionType": "dpkg"}], "platforms": ["Ubuntu 14.04 LTS", "Ubuntu 16.04 LTS", "Ubuntu 18.04 LTS", "Ubuntu 20.04 LTS", "Ubuntu 22.04 LTS", "Ubuntu 24.04 LTS", "Ubuntu 26.04 LTS", "Ubuntu 26.10"], "packageName": "accountsservice", "defaultStatus": "unaffected"}], "references": [{"url": "https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985", "name": "Launchpad Bug #2157985", "tags": ["issue-tracking"]}, {"url": "https://ubuntu.com/security/CVE-2026-61897", "name": "Ubuntu CVE Tracker", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-273", "description": "CWE-273: Improper Check for Dropped Privileges"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-08-20T14:32:53.827Z"}}}, "cveMetadata": {"cveId": "CVE-2026-61897", "state": "PUBLISHED", "dateUpdated": "2026-08-26T19:50:49.398Z", "dateReserved": "2026-07-11T18:43:51.251Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-08-20T14:32:53.827Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "accountsservice", "platforms": ["Ubuntu 14.04 LTS", "Ubuntu 16.04 LTS", "Ubuntu 18.04 LTS", "Ubuntu 20.04 LTS", "Ubuntu 22.04 LTS", "Ubuntu 24.04 LTS", "Ubuntu 26.04 LTS", "Ubuntu 26.10"], "product": "accountsservice", "vendor": "Canonical", "versions": [{"lessThan": "22.07.5-2ubuntu1.6", "status": "affected", "version": "22.07.5-2ubuntu1", "versionType": "dpkg"}, {"lessThan": "23.13.9-2ubuntu6.1", "status": "affected", "version": "23.13.9-2ubuntu6", "versionType": "dpkg"}, {"lessThan": "23.13.9-8ubuntu5.2", "status": "affected", "version": "23.13.9-8ubuntu5", "versionType": "dpkg"}, {"lessThan": "23.13.9-8ubuntu7", "status": "affected", "version": "23.13.9-8ubuntu6", "versionType": "dpkg"}]}], "source": "security@ubuntu.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation."}, {"lang": "es", "value": "Un parche espec\u00edfico de Ubuntu para AccountsService anterior a 23.13.9-8ubuntu7 solo reduce parcialmente los privilegios antes de lanzar los scripts auxiliares de idioma. Cambia el UID/GID efectivo al usuario objetivo, pero deja el UID real como 0 (root). Un shell generado por un script auxiliar hereda ruid=0 y puede restablecer su UID efectivo a root, lo que permite la escalada de privilegios local."}], "id": "CVE-2026-61897", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61897", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T19:43:37.600246Z", "version": "2.0.3"}}]}, "published": "2026-08-20T15:17:38.740", "references": [{"source": "security@ubuntu.com", "url": "https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985"}, {"source": "security@ubuntu.com", "url": "https://ubuntu.com/security/CVE-2026-61897"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-273"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{"bugzilla": {"description": "accountsservice: AccountsService: Local privilege escalation via incomplete privilege drop in language helper scripts", "id": "2520352", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520352"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-273", "details": ["A flaw was found in AccountsService. An Ubuntu-specific patch for AccountsService did not fully drop root privileges when launching language helper scripts. This oversight allows a local user to exploit the incomplete privilege drop, potentially enabling them to reset their effective user ID to root. This could lead to local privilege escalation, granting unauthorized administrative access to the system."], "name": "CVE-2026-61897", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "accountsservice", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "accountsservice", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "accountsservice", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "accountsservice", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-20T14:32:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-61897\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-61897\nhttps://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985\nhttps://ubuntu.com/security/CVE-2026-61897"], "statement": "This Important vulnerability in AccountsService stems from an Ubuntu-specific patch that incompletely drops privileges when launching language helper scripts. Red Hat products do not include this specific patch, therefore they are not directly affected by this flaw.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": ["ubuntu_14.04_lts", "ubuntu_16.04_lts", "ubuntu_18.04_lts", "ubuntu_20.04_lts", "ubuntu_22.04_lts", "ubuntu_24.04_lts", "ubuntu_26.04_lts", "ubuntu_26.10"], "status": "affected", "versions": {"scheme": "semver", "value": "[22.07.5-2ubuntu1,22.07.5-2ubuntu1.6)"}}, {"platform": ["ubuntu_14.04_lts", "ubuntu_16.04_lts", "ubuntu_18.04_lts", "ubuntu_20.04_lts", "ubuntu_22.04_lts", "ubuntu_24.04_lts", "ubuntu_26.04_lts", "ubuntu_26.10"], "status": "affected", "versions": {"scheme": "semver", "value": "[23.13.9-2ubuntu6,23.13.9-2ubuntu6.1)"}}, {"platform": ["ubuntu_14.04_lts", "ubuntu_16.04_lts", "ubuntu_18.04_lts", "ubuntu_20.04_lts", "ubuntu_22.04_lts", "ubuntu_24.04_lts", "ubuntu_26.04_lts", "ubuntu_26.10"], "status": "affected", "versions": {"scheme": "semver", "value": "[23.13.9-8ubuntu5,23.13.9-8ubuntu5.2)"}}, {"platform": ["ubuntu_14.04_lts", "ubuntu_16.04_lts", "ubuntu_18.04_lts", "ubuntu_20.04_lts", "ubuntu_22.04_lts", "ubuntu_24.04_lts", "ubuntu_26.04_lts", "ubuntu_26.10"], "status": "affected", "versions": {"scheme": "semver", "value": "[23.13.9-8ubuntu6,23.13.9-8ubuntu7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "accountsservice", "source": "cna", "vendor": "Canonical"}, "product": "accountsservice", "vendor": "canonical"}], "created": "2026-08-20T16:30:04.427851+00:00", "updated": "2026-08-20T21:00:05.526663+00:00", "vendors": ["canonical", "canonical$PRODUCT$accountsservice"]}