{"id":"CVE-2026-61897","aliases":["EUVD-2026-63379","GHSA-8h74-384h-cv6c","UBUNTU-CVE-2026-61897","USN-8580-1","USN-8580-2"],"status":"published","title":"accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts","description":"An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0014,"percentile":0.03416,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-273"],"published":"2026-07-21T16:00:00Z","modified":"2026-10-18T20:10:00Z","fixes":[{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"accountsservice","fixed_in":["0.6.35-0ubuntu7.3+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"accountsservice","fixed_in":["0.6.40-2ubuntu11.6+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"accountsservice","fixed_in":["0.6.45-1ubuntu1.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"accountsservice","fixed_in":["0.6.55-0ubuntu12~20.04.7+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"accountsservice","fixed_in":["22.07.5-2ubuntu1.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"accountsservice","fixed_in":["23.13.9-2ubuntu6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"accountsservice","fixed_in":["23.13.9-8ubuntu5.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.35-0ubuntu7.3+esm4"}]}],"versions":["0.6.34-0ubuntu6","0.6.34-0ubuntu7","0.6.35-0ubuntu1","0.6.35-0ubuntu2","0.6.35-0ubuntu3","0.6.35-0ubuntu4","0.6.35-0ubuntu5","0.6.35-0ubuntu6","0.6.35-0ubuntu7","0.6.35-0ubuntu7.1","0.6.35-0ubuntu7.2","0.6.35-0ubuntu7.3","0.6.35-0ubuntu7.3+esm2","0.6.35-0ubuntu7.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.40-2ubuntu11.6+esm2"}]}],"versions":["0.6.40-2ubuntu5","0.6.40-2ubuntu6","0.6.40-2ubuntu7","0.6.40-2ubuntu8","0.6.40-2ubuntu9","0.6.40-2ubuntu10","0.6.40-2ubuntu11","0.6.40-2ubuntu11.1","0.6.40-2ubuntu11.2","0.6.40-2ubuntu11.3","0.6.40-2ubuntu11.6","0.6.40-2ubuntu11.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.45-1ubuntu1.3+esm2"}]}],"versions":["0.6.42-0ubuntu3","0.6.42-0ubuntu4","0.6.45-1ubuntu1","0.6.45-1ubuntu1.3","0.6.45-1ubuntu1.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.55-0ubuntu12~20.04.7+esm1"}]}],"versions":["0.6.55-0ubuntu10","0.6.55-0ubuntu11","0.6.55-0ubuntu12~20.04.1","0.6.55-0ubuntu12~20.04.2","0.6.55-0ubuntu12~20.04.4","0.6.55-0ubuntu12~20.04.5","0.6.55-0ubuntu12~20.04.6","0.6.55-0ubuntu12~20.04.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.07.5-2ubuntu1.6"}]}],"versions":["0.6.55-0ubuntu14","0.6.55-3ubuntu1","0.6.55-3ubuntu2","0.6.55-3ubuntu4","0.6.55-3ubuntu5","0.6.55-3ubuntu6","22.07.5-2ubuntu1","22.07.5-2ubuntu1.3","22.07.5-2ubuntu1.4","22.07.5-2ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.13.9-2ubuntu6.1"}]}],"versions":["23.13.9-2ubuntu2","23.13.9-2ubuntu4","23.13.9-2ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.13.9-8ubuntu5.2"}]}],"versions":["23.13.9-7ubuntu1","23.13.9-8ubuntu1","23.13.9-8ubuntu2","23.13.9-8ubuntu4","23.13.9-8ubuntu5","23.13.9-8ubuntu5.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.07.5-2ubuntu1.6"}]}],"versions":["0.6.55-0ubuntu14","0.6.55-3ubuntu1","0.6.55-3ubuntu2","0.6.55-3ubuntu4","0.6.55-3ubuntu5","0.6.55-3ubuntu6","22.07.5-2ubuntu1","22.07.5-2ubuntu1.3","22.07.5-2ubuntu1.4","22.07.5-2ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.13.9-2ubuntu6.1"}]}],"versions":["23.13.9-2ubuntu2","23.13.9-2ubuntu4","23.13.9-2ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.13.9-8ubuntu5.2"}]}],"versions":["23.13.9-7ubuntu1","23.13.9-8ubuntu1","23.13.9-8ubuntu2","23.13.9-8ubuntu4","23.13.9-8ubuntu5","23.13.9-8ubuntu5.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.35-0ubuntu7.3+esm4"}]}],"versions":["0.6.34-0ubuntu6","0.6.34-0ubuntu7","0.6.35-0ubuntu1","0.6.35-0ubuntu2","0.6.35-0ubuntu3","0.6.35-0ubuntu4","0.6.35-0ubuntu5","0.6.35-0ubuntu6","0.6.35-0ubuntu7","0.6.35-0ubuntu7.1","0.6.35-0ubuntu7.2","0.6.35-0ubuntu7.3","0.6.35-0ubuntu7.3+esm2","0.6.35-0ubuntu7.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.40-2ubuntu11.6+esm2"}]}],"versions":["0.6.40-2ubuntu5","0.6.40-2ubuntu6","0.6.40-2ubuntu7","0.6.40-2ubuntu8","0.6.40-2ubuntu9","0.6.40-2ubuntu10","0.6.40-2ubuntu11","0.6.40-2ubuntu11.1","0.6.40-2ubuntu11.2","0.6.40-2ubuntu11.3","0.6.40-2ubuntu11.6","0.6.40-2ubuntu11.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.45-1ubuntu1.3+esm2"}]}],"versions":["0.6.42-0ubuntu3","0.6.42-0ubuntu4","0.6.45-1ubuntu1","0.6.45-1ubuntu1.3","0.6.45-1ubuntu1.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.55-0ubuntu12~20.04.7+esm1"}]}],"versions":["0.6.55-0ubuntu10","0.6.55-0ubuntu11","0.6.55-0ubuntu12~20.04.1","0.6.55-0ubuntu12~20.04.2","0.6.55-0ubuntu12~20.04.4","0.6.55-0ubuntu12~20.04.5","0.6.55-0ubuntu12~20.04.6","0.6.55-0ubuntu12~20.04.7"]}],"products":[{"vendor":"canonical","product":"accountsservice"},{"vendor":"ubuntu","product":"accountsservice"}],"references":[{"url":"https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985","tags":["issue-tracking"]},{"url":"https://ubuntu.com/security/CVE-2026-61897","tags":["vendor-advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61897"},{"url":"https://github.com/advisories/GHSA-8h74-384h-cv6c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61897","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8580-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8580-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-61898","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-61897","title":"accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts","description":"An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.","status":"published","published":"2026-08-20T14:32:53.827Z","modified":"2026-08-26T19:50:49.398Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T14:19:53.4444Z"}],"euvd":[{"id":"EUVD-2026-63379","description":"An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.","status":"published","published":"2026-08-20T14:32:53Z","modified":"2026-08-26T19:50:49Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:29.296861Z"}],"ghsa":[{"id":"GHSA-8h74-384h-cv6c","title":"An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops...","description":"An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.","status":"published","published":"2026-08-20T15:34:20Z","modified":"2026-08-20T15:34:20Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T15:10:46.520021Z"}],"nvd":[{"id":"CVE-2026-61897","description":"An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.","status":"published","published":"2026-08-20T15:17:38.74Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T14:12:40.302911Z"}],"osv":[{"id":"UBUNTU-CVE-2026-61897","description":"An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.","status":"published","published":"2026-07-21T16:00:00Z","modified":"2026-09-02T19:36:26.930869625Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"USN-8580-1","title":"accountsservice vulnerabilities","description":"It was discovered that the Ubuntu-specific SetLanguage patch to\nAccountsService incorrectly handled dropping privileges. A local attacker\ncould use this issue to execute arbitrary commands as an administrator.\n(CVE-2026-61897)\n\nIt was discovered that the Ubuntu-specific SetLanguage helpers for\nAccountsService incorrectly handled parsing configuration files. A local\nattacker could use this issue to execute arbitrary commands.\n(CVE-2026-61898)","status":"published","published":"2026-07-21T17:00:59Z","modified":"2026-08-24T10:00:25.209232656Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8580-2","title":"accountsservice vulnerabilities","description":"USN-8580-1 fixed vulnerabilities in AccountsService. This update provides\nthe corresponding fixes for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that the Ubuntu-specific SetLanguage patch to\n AccountsService incorrectly handled dropping privileges. A local attacker\n could use this issue to execute arbitrary commands as an administrator.\n (CVE-2026-61897)\n\n It was discovered that the Ubuntu-specific SetLanguage helpers for\n AccountsService incorrectly handled parsing configuration files. A local\n attacker could use this issue to execute arbitrary commands.\n (CVE-2026-61898)\n","status":"published","published":"2026-07-21T19:23:41Z","modified":"2026-08-24T10:00:33.159834443Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}