The id utility in uutils coreutils incorrectly handles the "pretty print" output when the real UID and effective UID differ. The implementation mistakenly uses the effective GID instead of the effective UID during the name lookup for the effective user, resulting in misleading diagnostic information. This misrepresentation can cause automated scripts or administrators to make erroneous decisions about file permissions or access control. The vulnerability is classified under CWE-451 (User Interface Misrepresentation) and has a CVSS v3.1 base score of 3.3 (low). There is no known exploit in the wild and no patch or official remediation level has been published.

The impact is limited to incorrect informational output from the id utility, which may mislead users or automated processes about user identity details. This could result in improper handling of file permissions or access control decisions. There is no direct impact on confidentiality, availability, or system integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be aware of the potential for misleading output from the id utility when real and effective UIDs differ and verify user identity information through alternative means if critical decisions depend on it.