Log in Start free

Vulnerability · Published Apr 22, 2026 · Assigned by canonical

CVE-2026-35370uutils coreutils id Incorrect Access-Control Decisions via Misrepresented Group Membership

Medium 4.4

In plain English

A medium-severity incorrect authorization in coreutils from Uutils. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.1%top 98.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rust-coreutilsno fix listedDEBIAN-CVE-2026-35370
Debian:13rust-coreutilsno fix listedDEBIAN-CVE-2026-35370
Debian:14rust-coreutils0.6.0-1DEBIAN-CVE-2026-35370
Ubuntu:24.04:LTSrust-coreutilsno fix listedUBUNTU-CVE-2026-35370
Ubuntu:25.10rust-coreutilsno fix listedUBUNTU-CVE-2026-35370
Ubuntu:26.04:LTSrust-coreutilsno fix listedUBUNTU-CVE-2026-35370
Ubuntu:26.10rust-coreutilsno fix listedUBUNTU-CVE-2026-35370

Affected products (as reported)

VendorProductVersions
Uutils coreutils see references

Weakness: CWE-863 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References