Local Privilege Escalation in authd by Canonical

CVE-2026-6970

What is CVE-2026-6970?

authd versions prior to 0.6.4 are affected by a logic error related to primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID (GID) is set differently from their user ID (UID), due to either account creation issues or manual changes, an update in the user's identity provider record can trigger authd to incorrectly reset the primary group ID to match the UID upon the next login. This misconfiguration causes new files and directories to be owned by the incorrect group, resulting in denial of service and potentially allowing unauthorized access to other local users.

References