CVE-2026-6970
published 2026-04-27CVE-2026-6970: authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID…
PriorityP336high7.3CVSS 4.0
AVLACLATPPRLUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.11%
1.5th percentile
authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID (GID) differs from their UID, either because the account was created with authd prior to version 0.5.4 or because the primary group was manually changed via the `authctl group set-gid` command, and the user's identity provider record is updated, authd incorrectly resets the user's primary group ID to their UID upon next login. This causes newly created files and directories to be owned by the wrong group, causing denial of service issues, and potentially granting unintended access to other local users and allowing local privilege escalation.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | authd | >= 0.6.0 < 0.6.4 | 0.6.4 |
| canonical | authd | >= 0.6.1 < 0.6.1ubuntu0.1 | 0.6.1ubuntu0.1 |
| github.com | canonical_authd | >= 0.6.0 < 0.6.4 | 0.6.4 |
| ubuntu | authd | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
authd vulnerability
vendor_ubuntu·2026-04-27
CVE-2026-6970 authd vulnerability
Title: authd vulnerability
Summary: authd could be made to escalate privileges.
It was discovered that authd incorrectly assigned the primary group ID to
users under certain conditions. A local attacker could possibly use this
issue to achieve privilege escalation, or gain unauthorized access to files
belonging to other users.
Instructions: After a standard system update you need to restart authd to make all the
necessary changes.
GHSA
authd: Primary group ID is incorrectly set to value of UID
ghsa·2026-05-05
CVE-2026-6970 [HIGH] CWE-842 authd: Primary group ID is incorrectly set to value of UID
authd: Primary group ID is incorrectly set to value of UID
authd 0.6.0 contains [a bug](https://github.com/canonical/authd/issues/1482) which can lead to an incorrect primary group ID.
It affects users whose primary group ID (i.e. the GID in the user record) differs from their UID. There are two ways which can lead to this:
1. The user was created with authd &2
continue
fi
if [ "$OLD_GID" = "$GID" ]; then
continue # user not affected
fi
USER_HOME=$(getent passwd "$user" | cut -d: -f6)
echo "Fixing $user: resetting GID from $OLD_GID to $GID"
sudo authctl group set-gid "$user" "$OLD_GID"
sudo authctl group set-gid "$user" "$GID"
sudo chown -R --from=":$OLD_GID" ":$GID" "$USER_HOME"
done
```
After applying the fix, affected users must log out and log back in for `id`, `groups`, and new fi
VulDB
Canonical authd up to 0.6.3 placement of user into incorrect group (GHSA-fg3j-5w9g-hmg7)
vuldb·2026-04-27·CVSS 7.3
CVE-2026-6970 [HIGH] Canonical authd up to 0.6.3 placement of user into incorrect group (GHSA-fg3j-5w9g-hmg7)
A vulnerability described as critical has been identified in Canonical authd up to 0.6.3. This affects an unknown function. Such manipulation leads to placement of user into incorrect group.
This vulnerability is referenced as CVE-2026-6970. The attack can only be performed from a local environment. No exploit is available.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-27
Published