Vulnerability · Published Aug 20, 2026 · Assigned by canonical

CVE-2026-61897accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts

High 7.8

In plain English

A high-severity security flaw in accountsservice from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.1%top 96.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	accountsservice	22.07.5-2ubuntu1.6	UBUNTU-CVE-2026-61897
Ubuntu:24.04:LTS	accountsservice	23.13.9-2ubuntu6.1	UBUNTU-CVE-2026-61897
Ubuntu:26.04:LTS	accountsservice	23.13.9-8ubuntu5.2	UBUNTU-CVE-2026-61897

Affected products (as reported)

Vendor	Product	Versions
Canonical	accountsservice	22.07.5-2ubuntu1 – before 22.07.5-2ubuntu1.623.13.9-2ubuntu6 – before 23.13.9-2ubuntu6.123.13.9-8ubuntu5 – before 23.13.9-8ubuntu5.223.13.9-8ubuntu6 – before 23.13.9-8ubuntu7

Weakness: CWE-273 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Launchpad Bug #2157985 issue-tracking
Ubuntu CVE Tracker vendor-advisory