CVE-2026-6970 is a vulnerability in Canonical's authd prior to version 0.6.4 involving improper handling of a user's primary group ID (GID). When the GID differs from the UID—either from legacy account creation or manual modification via `authctl group set-gid`—authd erroneously resets the GID to the UID upon the user's next login after an identity provider record update. This logic error leads to files and directories being assigned incorrect group ownership, which can cause denial of service and enable local privilege escalation by granting unintended access to other local users.

The vulnerability allows local users to escalate privileges by exploiting incorrect group ownership of files and directories. This misassignment can cause denial of service and unauthorized access to resources by other local users. The CVSS 4.0 score is 7.3 (high severity), reflecting the potential for privilege escalation with low attack complexity but requiring local access and partial user privileges.

No official patch or remediation level is currently documented by the vendor. Patch status is not yet confirmed—check the Canonical vendor advisory for current remediation guidance. Until a fix is available, avoid using affected versions 0.6.0 and 0.6.1 of authd in environments where this vulnerability could be exploited. Review user group assignments and avoid manual changes to primary group IDs that could trigger this issue.