PT-2026-35449 · Authd · Authd

Samikhan-De · Published 2026-04-27 · Updated 2026-05-06 · CVE-2026-6970

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions authd versions prior to 0.6.4

Description A logic error exists in the primary group ID assignment. When a user's primary group ID (GID) differs from their user ID (UID)—occurring if the account was created with versions prior to 0.5.4 or if the primary group was manually changed using the authctl group set-gid command—and the identity provider record is updated, the system incorrectly resets the primary group ID to the UID during the next login. This results in newly created files and directories being assigned to the wrong group, which can lead to denial of service, unauthorized access to files by other local users, and local privilege escalation.

Recommendations Update to version 0.6.4 or later.

Fix

DoS

LPE

Weakness Enumeration

CWE-842

Related Identifiers

CVE-2026-6970

GHSA-FG3J-5W9G-HMG7

USN-8212-1

Affected Products

Authd

References · 15

• https://github.com/canonical/authd/security/advisories/GHSA-fg3j-5w9g-hmg7 · Vendor Advisory
• https://github.com/canonical/authd/commit/154b428305cb1a7a19c897626fefd09d6dde8b9f · Patch
• https://ubuntu.com/security/CVE-2026-6970 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6970 · Security Note
• https://osv.dev/vulnerability/GHSA-fg3j-5w9g-hmg7 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8212-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-6970 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-6970 · Security Note
• https://ubuntu.com/security/notices/USN-8212-1 · Vendor Advisory
• https://github.com/canonical/authd · Note
• https://twitter.com/CVEnew/status/2048852141092028867 · Twitter Post
• https://twitter.com/dailycve/status/2051828802393616807 · Twitter Post
• https://t.me/CVEtracker/51962 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1t5dfkb/resumen_diario_de_vulnerabilidades_06052026 · Reddit Post
• https://twitter.com/HugoValters/status/2050607999891202557 · Twitter Post