CVE-2026-61897 is a vulnerability in Canonical Ubuntu Linux
Published on August 20, 2026
accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts
An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.
Weakness Type
Improper Check for Dropped Privileges
The software attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded. If the drop fails, the software will continue to run with the raised privileges, which might provide additional access to unprivileged users.
Products Associated with CVE-2026-61897
Want to know whenever a new CVE is published for Canonical Ubuntu Linux? stack.watch will email you.
Affected Versions
Canonical accountsservice:- Version 22.07.5-2ubuntu1 and below 22.07.5-2ubuntu1.6 is affected.
- Version 23.13.9-2ubuntu6 and below 23.13.9-2ubuntu6.1 is affected.
- Version 23.13.9-8ubuntu5 and below 23.13.9-8ubuntu5.2 is affected.
- Version 23.13.9-8ubuntu6 and below 23.13.9-8ubuntu7 is affected.