Accountsservice Vulnerability in Systemd-homed Code Path by Red Hat
CVE-2026-16743
5.5MEDIUM
What is CVE-2026-16743?
A vulnerability exists in the accountsservice component of Red Hat’s implementation. The flaw arises in the systemd-homed code path for SetIconFile, where user-supplied filenames are opened with root privileges without appropriate validation or privilege dropping mechanisms typical of the classic handler. This lack of security checks enables a local attacker, specifically one managing a systemd-homed account, to read any arbitrary files that are accessible to the accounts-daemon process, potentially leading to unauthorized data access.
References
CVSS V3.1
Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Thurein Oo for reporting this issue.