CVE-2026-16743 in Red Hat
Summary
by MITRE • 07/24/2026
A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability resides within the accountsservice package, specifically in the systemd-homed code path responsible for handling the SetIconFile functionality. This flaw represents a privilege escalation issue that stems from inadequate input validation and improper privilege management during file operations. The core technical issue occurs when the system processes user-supplied filenames through the systemd-homed interface without implementing the same security validations and privilege dropping mechanisms that are employed by the traditional handler components. This discrepancy creates an exploitable condition where local attackers with access to systemd-homed-managed accounts can manipulate the SetIconFile function to read arbitrary files that are accessible to the accounts-daemon process.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables a local attacker to potentially access sensitive data that the accounts-daemon process can read. This includes but is not limited to configuration files, user credentials, system logs, and other confidential information that may be accessible through the daemon's privileges. The vulnerability specifically affects systems utilizing systemd-homed for user account management, where the accounts-daemon process runs with elevated privileges to manage user home directories and related metadata. Attackers leveraging this flaw can bypass normal access controls and gain unauthorized read access to files that should normally be restricted to specific users or processes, effectively undermining the principle of least privilege that is fundamental to system security.
The vulnerability manifests as a direct consequence of improper privilege management within the systemd-homed code path, where the implementation fails to properly validate user inputs before processing them in a privileged context. This flaw aligns with common weakness patterns identified by CWE 22, which describes "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" and CWE 78, which covers "Improper Neutralization of Special Elements used in OS Command Injection." The issue also relates to privilege escalation categories within the ATT&CK framework under T1068, which addresses "Local Privilege Escalation," and T1566, which encompasses "Phishing," as attackers might use this vulnerability to gather intelligence for further attacks. Organizations running systems with systemd-homed enabled should immediately implement mitigations including restricting access to the accounts-daemon service, implementing proper input validation for all user-supplied data, and ensuring that privilege dropping mechanisms are consistently applied across all code paths handling sensitive operations.
Mitigation strategies should focus on strengthening the input validation pipeline within the systemd-homed component to ensure that all user-supplied filenames undergo proper sanitization before being processed in privileged contexts. System administrators should consider implementing additional access controls to limit which users can interact with the accounts-daemon service and restrict file permissions for sensitive system resources. The recommended approach involves applying patches from upstream maintainers that implement consistent privilege management across all code paths, including ensuring that any file operations performed by the accounts-daemon process drop privileges appropriately after validation. Organizations should also conduct security audits to identify other potential similar flaws in their system services and ensure that all components follow established security best practices for handling user inputs and managing privileged operations. The vulnerability demonstrates the importance of maintaining consistent security controls across all system components, particularly in areas where privilege escalation opportunities exist.