CVE-2026-61897: Canonical Accountsservice

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

Affected products

• Canonical Accountsservice: from 22.07.5-2ubuntu1, before 22.07.5-2ubuntu1.6 (fixed in 22.07.5-2ubuntu1.6); from 23.13.9-2ubuntu6, before 23.13.9-2ubuntu6.1 (fixed in 23.13.9-2ubuntu6.1); from 23.13.9-8ubuntu5, before 23.13.9-8ubuntu5.2 (fixed in 23.13.9-8ubuntu5.2); from 23.13.9-8ubuntu6, before 23.13.9-8ubuntu7 (fixed in 23.13.9-8ubuntu7)

Published 2026-08-20. Last modified 2026-08-28.