Bug 2520352 (CVE-2026-61897) - CVE-2026-61897 accountsservice: AccountsService: Local privilege escalation via incomplete privilege drop in language helper scripts
Summary: CVE-2026-61897 accountsservice: AccountsService: Local privilege escalation v...
Keywords:
Status: NEW
Alias: CVE-2026-61897
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-20 14:46 UTC by OSIDB Bzimport
Modified: 2026-08-24 10:19 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-20 14:46:23 UTC 
An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.
Note You need to log in before you can comment on or make changes to this bug.