The vulnerability in uutils coreutils' id utility arises from using the real GID rather than the effective GID to compute the groups= section of its output. This incorrect authorization check (CWE-863) leads to output that differs from the expected behavior of GNU coreutils. Since many security-critical scripts depend on the id output to enforce access controls, this miscalculation can cause improper permission decisions, potentially allowing unauthorized access or misconfigurations. The CVSS 3.1 base score is 4.4 (medium severity), reflecting local attack vector with low complexity and no user interaction required. There is no vendor-provided patch or official remediation information available at this time.

The impact is limited to incorrect group membership information being reported by the id utility in uutils coreutils. This can cause scripts and automated processes that rely on this output for security decisions to make incorrect authorization determinations, potentially leading to unauthorized access or security misconfigurations. There is no indication of direct system compromise or denial of service. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when relying on uutils coreutils' id output for security-critical decisions and consider using GNU coreutils as a trusted alternative if feasible.