CVE-2026-61897: CWE-273: Improper Check for Dropped Privileges in Canonical accountsservice
Description
CVE-2026-61897 is a local privilege escalation vulnerability in Ubuntu's accountsservice prior to version 23.13.9-8ubuntu7. The flaw arises because an Ubuntu-specific patch only partially drops privileges before launching language helper scripts, leaving the real user ID as root. This allows a shell spawned by the helper script to inherit root privileges and potentially regain full root access. The vulnerability has a high severity with a CVSS score of 7.8.
CVSS v3.1
Score 7.8high
Affected software
Canonical
accountsservice
pkg:deb/ubuntu/accountsserviceRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in accountsservice involves improper dropping of privileges before executing language helper scripts. Although the effective UID/GID is changed to the target user, the real UID remains 0 (root). Consequently, a shell spawned by these scripts inherits the real UID of root and can reset its effective UID back to root, enabling local privilege escalation. This affects specific Ubuntu package versions prior to 23.13.9-8ubuntu7 and related versions as detailed.
Potential Impact
An unprivileged local user can exploit this flaw to escalate privileges to root by leveraging the improper privilege dropping in accountsservice. This can lead to complete system compromise with full administrative rights.
Mitigation Recommendations
A fix is available in Ubuntu package versions 23.13.9-8ubuntu7 and later, which properly drops privileges before launching helper scripts. Users should upgrade to these fixed versions to remediate the vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- canonical
- Date Reserved
- 2026-07-11T18:43:51.251Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a871151acd9273b49bdeee4
Added to database: 08/20/2026, 14:38:09 UTC
Last enriched: 09/10/2026, 23:47:33 UTC
Last updated: 10/04/2026, 16:08:40 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.