What is GHSA-8h74-384h-cv6c?

GHSA-8h74-384h-cv6c is a security advisory published by GitHub Security Advisories with High severity. An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops...

Which CVE IDs does GHSA-8h74-384h-cv6c cover?

GHSA-8h74-384h-cv6c covers the following CVE IDs: CVE-2026-61897. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8h74-384h-cv6c?

GHSA-8h74-384h-cv6c has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

GHSA-8h74-384h-cv6cHighCVSS 7.8

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops...

Vendor

GitHub Security Advisories

Published

August 20, 2026

Last Modified

August 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-61897 →

📋 Description

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-61897
https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985
https://ubuntu.com/security/CVE-2026-61897
https://github.com/advisories/GHSA-8h74-384h-cv6c