The vulnerability in uutils coreutils' id utility arises from using the real GID rather than the effective GID to compute the groups= output. This incorrect authorization check (CWE-863) results in output that differs from the expected behavior of GNU coreutils. Since many security mechanisms depend on the id output for permission and access control decisions, this miscalculation can cause improper authorization, potentially allowing unauthorized access or misconfigured security settings. The CVSS 3.1 base score is 4.4 (medium), reflecting limited impact on confidentiality and integrity with no impact on availability. No patch or official remediation is currently documented.

Scripts and automated processes that rely on the id utility's groups= output for making security decisions may receive incorrect group membership information. This can lead to unauthorized access or security misconfigurations due to incorrect authorization checks. The impact affects confidentiality and integrity to a limited extent but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when relying on uutils coreutils' id utility output for security-critical decisions and consider using alternative tools such as GNU coreutils' id utility where accurate group membership information is critical.