CVE-2026-61897

creationtimestamp| type| source ---|---|--- 2026-08-20 17:01:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtjpvpsqty2r...

CVE-2026-61897

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...

CVE-2026-61897

An Ubuntu-specific AccountsService patch before 23.13.9-8ubuntu7 changes only the effective UID/GID to the target user while leaving the real UID as root (0). A shell spawned by a language helper script inherits ruid=0 and can reset its effective UID to root, enabling local privilege escalation t...

CVE-2026-61897 accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...

USN-8580-2: AccountsService vulnerabilities

USN-8580-1 fixed vulnerabilities in AccountsService. This update provides the corresponding fixes for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that the Ubuntu-specific SetLanguage patch to AccountsService incorrectly...

PT-2026-63319

Name of the Vulnerable Software and Affected Versions accountsservice versions prior to 23.13.9-8ubuntu7 Description Ubuntu-specific language helper scripts, specifically save-to-pam-env and update-langlist, fail to properly sanitize the LANGUAGE entry within the /.pam environment file. This inpu...