Canonical authd up to 0.6.3 placement of user into incorrect group

Summaryinfo

A vulnerability classified as critical has been found in Canonical authd up to 0.6.3. This impacts an unknown function. Performing a manipulation results in placement of user into incorrect group. This vulnerability is identified as CVE-2026-6970. The attack is only possible with local access. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Canonical authd up to 0.6.3. This affects some unknown processing. The manipulation with an unknown input leads to a placement of user into incorrect group vulnerability. CWE is classifying the issue as CWE-842. The product or the administrator places a user into an incorrect group. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID (GID) differs from their UID, either because the account was created with authd prior to version 0.5.4 or because the primary group was manually changed via the `authctl group set-gid` command, and the user's identity provider record is updated, authd incorrectly resets the user's primary group ID to their UID upon next login. This causes newly created files and directories to be owned by the wrong group, causing denial of service issues, and potentially granting unintended access to other local users and allowing local privilege escalation.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-6970 since 04/24/2026. The exploitability is told to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

Upgrading to version 0.6.4 eliminates this vulnerability. Applying the patch 154b428305cb1a7a19c897626fefd09d6dde8b9f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-25871). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Canonical

Name

• authd

Version

• 0.6.0
• 0.6.1
• 0.6.2
• 0.6.3

License

• open-source

Website

• Product: https://github.com/canonical/authd/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion