The id utility in uutils coreutils has a user interface misrepresentation vulnerability (CWE-451) where, when the real UID and effective UID differ, the implementation mistakenly uses the effective GID instead of the effective UID for name lookup of the effective user. This results in incorrect "pretty print" output that can mislead users or automated processes regarding user identity and permissions. The vulnerability has a CVSS 3.3 score indicating low severity and does not impact confidentiality or availability, only integrity of displayed information.

The vulnerability causes misleading output in the id utility's display of user identity information, potentially leading to incorrect administrative or automated decisions about file permissions or access control. There is no direct impact on system confidentiality or availability, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be aware of the potential for misleading output from the id utility when real and effective UIDs differ and verify user identity information through alternative means if critical decisions depend on it.